US-CERT Vulnerability Summary for the Week of December 9, 2024
Bulletins provide weekly summaries of new vulnerabilities. Patch information is provided when available.
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
High Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info |
|---|---|---|---|---|
| n/a — n/a | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1. | 2024-12-12 | 9.8 | CVE-2024-10124 |
| n/a — n/a | The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the ‘authenticate_user’ user function not implementing sufficient null value checks when setting the access token and user information. This makes it possible for unauthenticated attackers to log in as the first user who has signed in using Google OAuth, which could be the site administrator. | 2024-12-12 | 9.8 | CVE-2024-11015 |
| gfi — archiver | GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Telerik Web UI. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-24041. | 2024-12-12 | 9.8 | CVE-2024-11948 |
| totolink — ex1800t_firmware | A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 9.8 | CVE-2024-12352 |
| codezips — technical_discussion_forum | A vulnerability classified as critical was found in Codezips Technical Discussion Forum 1.0. This vulnerability affects unknown code of the file /signuppost.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | 2024-12-12 | 9.8 | CVE-2024-12484 |
| 1000projects — attendance_tracking_management_system | A vulnerability classified as critical has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected is an unknown function of the file /admin/check_admin_login.php. The manipulation of the argument admin_user_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 9.8 | CVE-2024-12497 |
| apple — ipados | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware. | 2024-12-12 | 9.8 | CVE-2024-44299 |
| n/a — n/a | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2024-12-12 | 9.8 | CVE-2024-49112 |
| apple — macos | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges. | 2024-12-12 | 9.8 | CVE-2024-54465 |
| apple — macos | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.2. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware. | 2024-12-12 | 9.8 | CVE-2024-54506 |
| apple — watchos | The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption. | 2024-12-12 | 9.8 | CVE-2024-54534 |
| lopalopa — e-learning_management_system | A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and class_id parameters. | 2024-12-09 | 9.8 | CVE-2024-54920 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was contacted and it was learned that the product is not supported. | 2024-12-09 | 9.8 | CVE-2024-8259 |
| n/a — n/a | The Super Backup & Clone – Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. | 2024-12-13 | 9.8 | CVE-2024-9290 |
| n/a — n/a | Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver. | 2024-12-12 | 9.3 | CVE-2024-49147 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 9.3 | CVE-2024-54032 |
| n/a — n/a | The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all versions up to, and including, 4.07. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible. Due to the presence of an .htaccess file, this can only be exploited to achieve RCE on NGINX servers, unless another vulnerability is present. | 2024-12-12 | 8.8 | CVE-2024-10590 |
| n/a — n/a | The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debranding_save() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. | 2024-12-12 | 8.8 | CVE-2024-11443 |
| n/a — n/a | The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or incorrect nonce validation on the displaySettingsPage() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-12 | 8.8 | CVE-2024-11689 |
| gfi — archiver | GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029. | 2024-12-12 | 8.8 | CVE-2024-11947 |
| gfi — archiver | GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331. | 2024-12-12 | 8.8 | CVE-2024-11949 |
| n/a — n/a | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the ‘theme’ attribute of the `wcpcsu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | 2024-12-12 | 8.8 | CVE-2024-12040 |
| jwillber — jfinalcms | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 8.8 | CVE-2024-12349 |
| jwillber — jfinalcms | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 8.8 | CVE-2024-12350 |
| jwillber — jfinalcms | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. | 2024-12-09 | 8.8 | CVE-2024-12351 |
| datax-web_project — datax-web | A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 8.8 | CVE-2024-12358 |
| online_class_and_exam_scheduling_system_project — online_class_and_exam_scheduling_system | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processing of the file class_update.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 8.8 | CVE-2024-12360 |
| google — chrome | Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-12-12 | 8.8 | CVE-2024-12381 |
| google — chrome | Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 2024-12-12 | 8.8 | CVE-2024-12382 |
| cjbi — wetech-cms | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function searchTopicByKeyword of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-12 | 8.8 | CVE-2024-12479 |
| cjbi — wetech-cms | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been classified as critical. Affected is the function searchTopic of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument con leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-12 | 8.8 | CVE-2024-12480 |
| cjbi — wetech-cms | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\UserDao.java. The manipulation of the argument searchValue/gId/rId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-12 | 8.8 | CVE-2024-12481 |
| fabian — online_class_and_exam_scheduling_system | A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown processing of the file /pages/department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12485 |
| fabian — online_class_and_exam_scheduling_system | A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/rank_update.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12486 |
| fabian — online_class_and_exam_scheduling_system | A vulnerability has been found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/room_update.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12487 |
| fabian — online_class_and_exam_scheduling_system | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/subject_update.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12488 |
| fabian — online_class_and_exam_scheduling_system | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/term.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12489 |
| anisha — farmacia | A vulnerability was found in code-projects Farmacia 1.0. It has been rated as critical. This issue affects some unknown processing of the file /visualizar-usuario.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 8.8 | CVE-2024-12492 |
| n/a — n/a | Windows IP Routing Management Snapin Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49080 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49085 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49086 |
| n/a — n/a | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49093 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49102 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49104 |
| n/a — n/a | Windows Hyper-V Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49117 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 8.8 | CVE-2024-49125 |
| apple — macos | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox. | 2024-12-12 | 8.8 | CVE-2024-54498 |
| apple — watchos | A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption. | 2024-12-12 | 8.8 | CVE-2024-54505 |
| lopalopa — e-learning_management_system | A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the school_year parameter. | 2024-12-09 | 8.8 | CVE-2024-54926 |
| n/a — n/a | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘wpforms_is_admin_page’ function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions. | 2024-12-10 | 8.5 | CVE-2024-11205 |
| n/a — n/a | Microsoft/Muzic Remote Code Execution Vulnerability | 2024-12-12 | 8.4 | CVE-2024-49063 |
| n/a — n/a | Remote Desktop Client Remote Code Execution Vulnerability | 2024-12-12 | 8.4 | CVE-2024-49105 |
| n/a — n/a | Microsoft SharePoint Elevation of Privilege Vulnerability | 2024-12-12 | 8.2 | CVE-2024-49068 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 8.2 | CVE-2024-54036 |
| n/a — n/a | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token. | 2024-12-12 | 8.1 | CVE-2024-10111 |
| n/a — n/a | The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note 5.2.1 contains a partial patch, though we consider 5.3 to be the complete patch. | 2024-12-13 | 8.1 | CVE-2024-10783 |
| n/a — n/a | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the ‘Role’ field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form. | 2024-12-14 | 8.1 | CVE-2024-11721 |
| n/a — n/a | The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the ‘designer-saved-projects’ cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. | 2024-12-12 | 8.1 | CVE-2024-12312 |
| n/a — n/a | Microsoft Defender for Endpoint on Android Spoofing Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49057 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49106 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49108 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49115 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49116 |
| n/a — n/a | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49118 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49119 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49120 |
| n/a — n/a | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49122 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49123 |
| n/a — n/a | Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49124 |
| n/a — n/a | Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49126 |
| n/a — n/a | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49127 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49128 |
| n/a — n/a | Windows Remote Desktop Services Remote Code Execution Vulnerability | 2024-12-12 | 8.1 | CVE-2024-49132 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 8 | CVE-2024-54034 |
| ivanti — security_controls | Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation. | 2024-12-11 | 7.8 | CVE-2024-10251 |
| razormist — phone_contact_manager_system | A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 7.8 | CVE-2024-12353 |
| razormist — phone_contact_manager_system | A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 7.8 | CVE-2024-12354 |
| razormist — phone_contact_manager_system | A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function ContactBook::adding of the file ContactBook.cpp. The manipulation leads to improper input validation. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 7.8 | CVE-2024-12355 |
| n/a — n/a | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command line access to the ‘scalemgmt’ user can elevate privileges to gain root access to the host operating system. | 2024-12-14 | 7.8 | CVE-2024-31891 |
| n/a — n/a | Microsoft Office Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-43600 |
| apple — macos | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. A malicious app may be able to gain root privileges. | 2024-12-12 | 7.8 | CVE-2024-44291 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-45155 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-45156 |
| n/a — n/a | Microsoft Excel Remote Code Execution Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49069 |
| n/a — n/a | Windows Task Scheduler Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49072 |
| n/a — n/a | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49074 |
| n/a — n/a | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49076 |
| n/a — n/a | Input Method Editor (IME) Remote Code Execution Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49079 |
| n/a — n/a | Windows Common Log File System Driver Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49088 |
| n/a — n/a | Windows Common Log File System Driver Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49090 |
| n/a — n/a | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49114 |
| microsoft — windows_server_2008 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49138 |
| n/a — n/a | Microsoft Access Remote Code Execution Vulnerability | 2024-12-12 | 7.8 | CVE-2024-49142 |
| n/a — n/a | Not a product versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49513 |
| n/a — n/a | After Effects versions 24.6.2, 25.0.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49537 |
| n/a — n/a | Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49538 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49543 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49544 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49545 |
| n/a — n/a | Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49551 |
| n/a — n/a | Media Encoder versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49552 |
| n/a — n/a | Media Encoder versions 25.0, 24.6.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-49553 |
| n/a — n/a | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions), SIMATIC STEP 7 Safety V18 (All versions), SIMATIC STEP 7 Safety V19 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions), SIMATIC WinCC Unified V16 (All versions), SIMATIC WinCC Unified V17 (All versions), SIMATIC WinCC Unified V18 (All versions), SIMATIC WinCC Unified V19 (All versions), SIMATIC WinCC V16 (All versions), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions), SIMOCODE ES V16 (All versions), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SIMOTION SCOUT TIA V5.6 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), TIA Portal Cloud V16 (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions). Affected products do not properly sanitize user-controllable input when parsing log files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. | 2024-12-10 | 7.8 | CVE-2024-49849 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52831 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52982 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52983 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52984 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52985 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52986 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52987 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52988 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52989 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite (‘Buffer Underflow’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to manipulate memory in such a way that they could execute code under the privileges of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52990 |
| n/a — n/a | Substance3D – Sampler versions 4.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52994 |
| n/a — n/a | Substance3D – Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52995 |
| n/a — n/a | Substance3D – Sampler versions 4.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52996 |
| n/a — n/a | Photoshop Desktop versions 26.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52997 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-52999 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53000 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53001 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53002 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53003 |
| n/a — n/a | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0016), Tecnomatix Plant Simulation V2404 (All versions < V2404.0005). The affected applications contain a stack based overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-25000) | 2024-12-10 | 7.8 | CVE-2024-53041 |
| n/a — n/a | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0016), Tecnomatix Plant Simulation V2404 (All versions < V2404.0005). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-25206) | 2024-12-10 | 7.8 | CVE-2024-53242 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53953 |
| n/a — n/a | Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53954 |
| adobe — bridge | Bridge versions 14.1.3, 15.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53955 |
| adobe — premiere_pro | Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53956 |
| adobe — substance_3d_painter | Substance3D – Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53957 |
| adobe — substance_3d_painter | Substance3D – Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53958 |
| adobe — framemaker | Adobe Framemaker versions 2020.7, 2022.5 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7.8 | CVE-2024-53959 |
| n/a — n/a | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted ASM files. This could allow an attacker to execute code in the context of the current process. | 2024-12-10 | 7.8 | CVE-2024-54093 |
| n/a — n/a | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. | 2024-12-10 | 7.8 | CVE-2024-54094 |
| n/a — n/a | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 10). The affected application is vulnerable to integer underflow vulnerability which can be triggered while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. | 2024-12-10 | 7.8 | CVE-2024-54095 |
| apple — macos | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Running a mount command may unexpectedly execute arbitrary code. | 2024-12-12 | 7.8 | CVE-2024-54489 |
| apple — macos | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges. | 2024-12-12 | 7.8 | CVE-2024-54515 |
| ivanti — workspace_control | Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation. | 2024-12-11 | 7.8 | CVE-2024-8496 |
| ivanti — automation | Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation. | 2024-12-11 | 7.8 | CVE-2024-9845 |
| n/a — n/a | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure. | 2024-12-10 | 7.7 | CVE-2023-6947 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the ‘resumeid’ parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-14 | 7.5 | CVE-2024-11711 |
| n/a — n/a | The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user’s metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0. | 2024-12-12 | 7.5 | CVE-2024-12172 |
| n/a — n/a | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements. | 2024-12-14 | 7.5 | CVE-2024-31892 |
| n/a — n/a | A flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests. | 2024-12-12 | 7.5 | CVE-2024-4109 |
| gstreamer_project — gstreamer | GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are enclosed in curly brackets ({}). The issue arises when a closing curly bracket “}” appears before an opening curly bracket “{” in the input string. In this case, memmove() incorrectly duplicates a substring. With each successive loop iteration, the size passed to memmove() becomes progressively larger (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in 1.24.10. | 2024-12-12 | 7.5 | CVE-2024-47541 |
| gstreamer_project — gstreamer | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. | 2024-12-12 | 7.5 | CVE-2024-47542 |
| n/a — n/a | Windows Remote Desktop Services Denial of Service Vulnerability | 2024-12-12 | 7.5 | CVE-2024-49075 |
| n/a — n/a | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | 2024-12-12 | 7.5 | CVE-2024-49096 |
| n/a — n/a | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | 2024-12-12 | 7.5 | CVE-2024-49113 |
| n/a — n/a | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | 2024-12-12 | 7.5 | CVE-2024-49121 |
| n/a — n/a | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | 2024-12-12 | 7.5 | CVE-2024-49129 |
| huawei — harmonyos | Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | 7.5 | CVE-2024-54103 |
| huawei — harmonyos | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | 7.5 | CVE-2024-54104 |
| huawei — harmonyos | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54105 |
| huawei — harmonyos | Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54106 |
| huawei — harmonyos | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54107 |
| huawei — harmonyos | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54108 |
| huawei — harmonyos | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54109 |
| huawei — harmonyos | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | 7.5 | CVE-2024-54110 |
| huawei — harmonyos | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54111 |
| huawei — harmonyos | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | 7.5 | CVE-2024-54112 |
| huawei — harmonyos | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption. | 2024-12-12 | 7.5 | CVE-2024-54113 |
| huawei — harmonyos | Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54114 |
| huawei — harmonyos | Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | 7.5 | CVE-2024-54115 |
| huawei — harmonyos | Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. | 2024-12-12 | 7.5 | CVE-2024-54116 |
| huawei — harmonyos | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | 7.5 | CVE-2024-54117 |
| apple — watchos | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. | 2024-12-12 | 7.5 | CVE-2024-54479 |
| apple — watchos | The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. | 2024-12-12 | 7.5 | CVE-2024-54508 |
| n/a — n/a | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity. | 2024-12-12 | 7.4 | CVE-2024-12397 |
| n/a — n/a | Microsoft SharePoint Remote Code Execution Vulnerability | 2024-12-12 | 7.4 | CVE-2024-49070 |
| n/a — n/a | The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 2024-12-12 | 7.3 | CVE-2024-10910 |
| n/a — n/a | System Center Operations Manager Elevation of Privilege Vulnerability | 2024-12-12 | 7.3 | CVE-2024-43594 |
| n/a — n/a | WmsRepair Service Elevation of Privilege Vulnerability | 2024-12-12 | 7.3 | CVE-2024-49107 |
| n/a — n/a | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions), SIMATIC STEP 7 Safety V18 (All versions), SIMATIC STEP 7 Safety V19 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified V17 (All versions), SIMATIC WinCC Unified V18 (All versions), SIMATIC WinCC Unified V19 (All versions), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SIMOTION SCOUT TIA V5.6 SP1 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions). The affected devices do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to locally execute arbitrary commands in the host operating system with the privileges of the user. | 2024-12-10 | 7.3 | CVE-2024-52051 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 7.3 | CVE-2024-54037 |
| n/a — n/a | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form’s subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 7.2 | CVE-2024-10646 |
| n/a — n/a | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 7.2 | CVE-2024-11052 |
| n/a — n/a | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default. | 2024-12-14 | 7.2 | CVE-2024-11720 |
| n/a — n/a | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | 2024-12-12 | 7.2 | CVE-2024-49089 |
| n/a — n/a | Windows Domain Name Service Remote Code Execution Vulnerability | 2024-12-12 | 7.2 | CVE-2024-49091 |
| lopalopa — e-learning_management_system | A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters. | 2024-12-09 | 7.2 | CVE-2024-54922 |
| lopalopa — e-learning_management_system | KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php. | 2024-12-09 | 7.2 | CVE-2024-54929 |
| lopalopa — e-learning_management_system | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php. | 2024-12-09 | 7.2 | CVE-2024-54930 |
| lopalopa — e-learning_management_system | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php. | 2024-12-09 | 7.2 | CVE-2024-54933 |
| n/a — n/a | The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘process_uploaded_files’ function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible. | 2024-12-14 | 7.2 | CVE-2024-9698 |
| n/a — n/a | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks. | 2024-12-11 | 7.1 | CVE-2024-11840 |
| apple — macos | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to overwrite arbitrary files. | 2024-12-12 | 7.1 | CVE-2024-54528 |
| n/a — n/a | Microsoft Office Elevation of Privilege Vulnerability | 2024-12-12 | 7 | CVE-2024-49059 |
| n/a — n/a | Windows Kernel Elevation of Privilege Vulnerability | 2024-12-12 | 7 | CVE-2024-49084 |
| n/a — n/a | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 2024-12-12 | 7 | CVE-2024-49095 |
| n/a — n/a | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability | 2024-12-12 | 7 | CVE-2024-49097 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 7 | CVE-2024-49530 |
Medium Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info |
|---|---|---|---|---|
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49073 |
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49077 |
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49078 |
| n/a — n/a | Windows File Explorer Information Disclosure Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49082 |
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49083 |
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49092 |
| n/a — n/a | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability | 2024-12-12 | 6.8 | CVE-2024-49110 |
| n/a — n/a | Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability | 2024-12-12 | 6.6 | CVE-2024-49081 |
| n/a — n/a | Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability | 2024-12-12 | 6.6 | CVE-2024-49094 |
| n/a — n/a | Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability | 2024-12-12 | 6.6 | CVE-2024-49101 |
| n/a — n/a | Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability | 2024-12-12 | 6.6 | CVE-2024-49109 |
| n/a — n/a | Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability | 2024-12-12 | 6.6 | CVE-2024-49111 |
| n/a — n/a | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-13 | 6.5 | CVE-2019-25221 |
| n/a — n/a | The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the ‘arg1’ arg of the ‘gvn_schart_2’ shortcode in all versions up to, and including, 2.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-12 | 6.5 | CVE-2024-11430 |
| n/a — n/a | The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_instagram_ajax_query AJAX action. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 2024-12-12 | 6.5 | CVE-2024-12333 |
| n/a — n/a | The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘owt7_borrow_books_id’ parameter in all versions up to, and including, 3.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-12 | 6.5 | CVE-2024-12406 |
| n/a — n/a | The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 2024-12-13 | 6.5 | CVE-2024-12417 |
| n/a — n/a | The The WPMobile.App – Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 2024-12-13 | 6.5 | CVE-2024-12420 |
| n/a — n/a | The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.16.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. The Cross-Site Scripting was patched in version 5.16.7.1, while the arbitrary shortcode execution was patched in 5.16.7.2. | 2024-12-13 | 6.5 | CVE-2024-12421 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. | 2024-12-10 | 6.5 | CVE-2024-43729 |
| apple — macos | This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.2, macOS Sonoma 14.7.2. A user with screen sharing access may be able to view another user’s screen. | 2024-12-12 | 6.5 | CVE-2024-44248 |
| n/a — n/a | Microsoft SharePoint Information Disclosure Vulnerability | 2024-12-12 | 6.5 | CVE-2024-49062 |
| n/a — n/a | Microsoft SharePoint Information Disclosure Vulnerability | 2024-12-12 | 6.5 | CVE-2024-49064 |
| n/a — n/a | Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network. | 2024-12-12 | 6.5 | CVE-2024-49071 |
| n/a — n/a | IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation. | 2024-12-12 | 6.5 | CVE-2024-52901 |
| apple — watchos | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Processing a maliciously crafted font may result in the disclosure of process memory. | 2024-12-12 | 6.5 | CVE-2024-54486 |
| n/a — n/a | The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-10182 |
| n/a — n/a | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery’ widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-10784 |
| n/a — n/a | The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | 2024-12-14 | 6.4 | CVE-2024-11095 |
| n/a — n/a | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘arenablog’ shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11384 |
| n/a — n/a | The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11410 |
| n/a — n/a | The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘bestelformulier’ shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11413 |
| n/a — n/a | The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘catch-popup’ shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11427 |
| n/a — n/a | The Surbma | SalesAutopilot Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘sa-form’ shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11433 |
| n/a — n/a | The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘horizontal-scroll-image-slideshow’ shortcode in all versions up to, and including, 10.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11442 |
| n/a — n/a | The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘onlyoffice-docspace’ shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11750 |
| n/a — n/a | The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘tcbd-popover-image ‘ shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11751 |
| n/a — n/a | The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘eveeno’ shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11752 |
| n/a — n/a | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘trafftbooking’ shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-11754 |
| n/a — n/a | The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11755 |
| n/a — n/a | The WP GeoNames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘wp-geonames’ shortcode in all versions up to, and including, 1.9.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11757 |
| n/a — n/a | The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘bukza’ shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11759 |
| n/a — n/a | The Currency Converter Widget ? PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘currency-converter-widget-pro’ shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11760 |
| n/a — n/a | The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘plezi’ shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11763 |
| n/a — n/a | The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘gs_portfolio’ shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11765 |
| n/a — n/a | The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘gs_book_showcase’ shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11766 |
| n/a — n/a | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘newsman_subscribe_widget’ shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-11767 |
| n/a — n/a | The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘post-cs’ shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11770 |
| n/a — n/a | The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘smartagenda’ shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11781 |
| n/a — n/a | The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘firebase_show’ shortcode in all versions up to, and including, 0.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11785 |
| n/a — n/a | The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ootb_query shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-11827 |
| n/a — n/a | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row settings in all versions up to, and including, 2.8.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-11832 |
| n/a — n/a | The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11855 |
| n/a — n/a | The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on tab descriptions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11865 |
| n/a — n/a | The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘companion-portfolio’ shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11867 |
| n/a — n/a | The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘buk’ shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11869 |
| n/a — n/a | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘patreon’ shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11871 |
| n/a — n/a | The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘glomex_integration’ shortcode in all versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11873 |
| n/a — n/a | The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘fuss’ shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11875 |
| n/a — n/a | The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘kredeum_opensky’ shortcode in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11876 |
| n/a — n/a | The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘cricket_score’ shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11877 |
| n/a — n/a | The Stripe Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘stripe_donation’ shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11879 |
| n/a — n/a | The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘faq’ shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11882 |
| n/a — n/a | The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘cnx_script_code’ shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11883 |
| n/a — n/a | The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘wp-photo-slider’ shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11884 |
| n/a — n/a | The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘ider_login_button’ shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11888 |
| n/a — n/a | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘homeasap-idx-search’ shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11889 |
| n/a — n/a | The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘pfai’ shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11891 |
| n/a — n/a | The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘permalink’ shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-11894 |
| n/a — n/a | The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘MO_API_POWER_BI’ shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11901 |
| n/a — n/a | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-11910 |
| n/a — n/a | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attire-blocks/post-carousel’ block in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-11914 |
| n/a — n/a | The iChart – Easy Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-10 | 6.4 | CVE-2024-11928 |
| n/a — n/a | The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘price’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-10 | 6.4 | CVE-2024-11940 |
| n/a — n/a | The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-10 | 6.4 | CVE-2024-11945 |
| n/a — n/a | The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘gmptp_single_post’ shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12446 |
| n/a — n/a | The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘papvfwc_views’ shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12448 |
| n/a — n/a | The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘spb-button’ shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12458 |
| n/a — n/a | The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘toggle’ shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12459 |
| n/a — n/a | The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘wprevive_async’ shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-12461 |
| n/a — n/a | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘arena_embed_amp’ shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 6.4 | CVE-2024-12463 |
| n/a — n/a | The Property Hive Stamp Duty Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘stamp_duty_calculator_scotland’ shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-13 | 6.4 | CVE-2024-12465 |
| n/a — n/a | The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘gds-country-dropdown’ shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12474 |
| n/a — n/a | The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12501 |
| n/a — n/a | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘homeasap-idx-landing’ shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12502 |
| n/a — n/a | The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘cart_button’ shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12517 |
| n/a — n/a | The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘states_map’ shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.4 | CVE-2024-12523 |
| n/a — n/a | The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. | 2024-12-13 | 6.3 | CVE-2024-11012 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability that could result in arbitrary code execution. This vulnerability allows an attacker to provide malicious XML input containing a reference to an external entity, leading to data disclosure or potentially code execution. Exploitation of this issue requires user interaction in that a victim must process a malicious XML document. | 2024-12-10 | 6.3 | CVE-2024-49535 |
| n/a — n/a | The Schema App Structured Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11279 |
| n/a — n/a | The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11359 |
| n/a — n/a | The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due to missing or incorrect nonce validation on the djo_einstellungen_menue() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11417 |
| n/a — n/a | The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the get3_init_admin_page() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11419 |
| n/a — n/a | The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ip’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11459 |
| n/a — n/a | The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fstab’ and ‘filestack_options’ parameters in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-14 | 6.1 | CVE-2024-11462 |
| n/a — n/a | The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘token_type’ parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11683 |
| n/a — n/a | The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcode present in all versions up to, and including, 2.3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11723 |
| n/a — n/a | The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-11804 |
| n/a — n/a | The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘img_src’ parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-13 | 6.1 | CVE-2024-11809 |
| n/a — n/a | The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘sourate’ and ‘lang’ parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-10 | 6.1 | CVE-2024-11973 |
| n/a — n/a | The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-11 | 6.1 | CVE-2024-12004 |
| n/a — n/a | The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. | 2024-12-12 | 6.1 | CVE-2024-12072 |
| n/a — n/a | The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12156 |
| n/a — n/a | The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12160 |
| n/a — n/a | The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12162 |
| n/a — n/a | The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12258 |
| n/a — n/a | The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12260 |
| n/a — n/a | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-11 | 6.1 | CVE-2024-12283 |
| n/a — n/a | The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link while logged in to turboSMTP. | 2024-12-10 | 6.1 | CVE-2024-12323 |
| n/a — n/a | The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-11 | 6.1 | CVE-2024-12325 |
| n/a — n/a | The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12338 |
| n/a — n/a | The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-14 | 6.1 | CVE-2024-12411 |
| n/a — n/a | The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-14 | 6.1 | CVE-2024-12422 |
| n/a — n/a | The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | 2024-12-12 | 6.1 | CVE-2024-12441 |
| n/a — n/a | The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-14 | 6.1 | CVE-2024-12555 |
| n/a — n/a | The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-13 | 6.1 | CVE-2024-12572 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 6.1 | CVE-2024-49550 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 6.1 | CVE-2024-54049 |
| n/a — n/a | The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the WooCommerce store is set to Belgium. | 2024-12-13 | 6.1 | CVE-2024-9608 |
| ujcms — ujcms | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 5.9 | CVE-2024-12483 |
| apple — watchos | A race condition was addressed with additional validation. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An attacker may be able to create a read-only memory mapping that can be written to. | 2024-12-12 | 5.9 | CVE-2024-54494 |
| apple — iphone_os | The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, macOS Ventura 13.7.2, iOS 18.1 and iPadOS 18.1, macOS Sonoma 14.7.2. Processing a malicious crafted file may lead to a denial-of-service. | 2024-12-12 | 5.5 | CVE-2024-44201 |
| apple — macos | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to access protected user data. | 2024-12-12 | 5.5 | CVE-2024-44300 |
| n/a — n/a | Microsoft Office Remote Code Execution Vulnerability | 2024-12-12 | 5.5 | CVE-2024-49065 |
| n/a — n/a | Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49541 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49546 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49547 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49548 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49549 |
| n/a — n/a | Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-49554 |
| n/a — n/a | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The Generic Data Mapper, the Engineering Adapter, and the Engineering Interface improperly handle XML External Entity (XXE) entries when parsing configuration and mapping files. This could allow an attacker to extract any file with a known location on the user’s system or accessible network folders by persuading a user to use a maliciously crafted configuration or mapping file in one of the affected components. | 2024-12-10 | 5.5 | CVE-2024-49704 |
| n/a — n/a | Substance3D – Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-52833 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-53004 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-53005 |
| adobe — substance_3d_modeler | Substance3D – Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-53006 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-53951 |
| n/a — n/a | InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 5.5 | CVE-2024-53952 |
| apple — macos | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to access user-sensitive data. | 2024-12-12 | 5.5 | CVE-2024-54474 |
| apple — macos | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to access user-sensitive data. | 2024-12-12 | 5.5 | CVE-2024-54477 |
| apple — macos | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. | 2024-12-12 | 5.5 | CVE-2024-54484 |
| apple — watchos | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Processing a maliciously crafted image may result in disclosure of process memory. | 2024-12-12 | 5.5 | CVE-2024-54500 |
| apple — macos | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. | 2024-12-12 | 5.5 | CVE-2024-54504 |
| apple — watchos | A permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2. An app may be able to access sensitive user data. | 2024-12-12 | 5.5 | CVE-2024-54513 |
| apple — watchos | The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. A malicious app may be able to access private information. | 2024-12-12 | 5.5 | CVE-2024-54526 |
| apple — watchos | This issue was addressed with improved checks. This issue is fixed in watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to access sensitive user data. | 2024-12-12 | 5.5 | CVE-2024-54527 |
| apple — macos | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. An app may be able to bypass kASLR. | 2024-12-12 | 5.5 | CVE-2024-54531 |
| n/a — n/a | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_title’ parameter in all versions up to, and including, 1.20.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 2024-12-12 | 5.4 | CVE-2024-10583 |
| n/a — n/a | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file. | 2024-12-13 | 5.4 | CVE-2024-12042 |
| code-projects — admin_dashboard | A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendor_management.php. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting product names. | 2024-12-09 | 5.4 | CVE-2024-12359 |
| mayurik — advocate_office_management_system | A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/client_data.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 5.4 | CVE-2024-12536 |
| n/a — n/a | The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | 2024-12-13 | 5.4 | CVE-2024-12574 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim’s browser. This issue occurs when data from a user-controllable source is improperly sanitized before being used in the Document Object Model (DOM) of a web page, leading to the execution of malicious scripts. Exploitation of this issue requires user interaction, such as tricking a victim into clicking a link or navigating to a malicious website. | 2024-12-10 | 5.4 | CVE-2024-43712 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script. | 2024-12-10 | 5.4 | CVE-2024-43713 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a vulnerable page. | 2024-12-10 | 5.4 | CVE-2024-43714 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-43715 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43718 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input. | 2024-12-10 | 5.4 | CVE-2024-43719 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim’s browser session. By manipulating the DOM environment in the victim’s browser, an attacker can inject malicious scripts that are executed by the victim’s browser. Exploitation of this issue requires user interaction, typically in the form of following a malicious link. | 2024-12-10 | 5.4 | CVE-2024-43720 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page. | 2024-12-10 | 5.4 | CVE-2024-43721 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input. | 2024-12-10 | 5.4 | CVE-2024-43722 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or page. | 2024-12-10 | 5.4 | CVE-2024-43723 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. Exploitation of this issue requires user interaction. | 2024-12-10 | 5.4 | CVE-2024-43724 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43725 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43726 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43727 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43728 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43730 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-43733 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43734 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-43735 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43736 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43737 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim’s browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the execution of unintended script code or the alteration of the intended user interface. User interaction is required as the victim must visit a malicious page or view a maliciously crafted link. | 2024-12-10 | 5.4 | CVE-2024-43738 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43739 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43740 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43742 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43743 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43744 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-43745 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43746 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43747 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43748 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43749 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43750 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43751 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-43752 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim’s browser. This issue occurs when data from a malicious source is processed by a web application’s client-side scripts to update the DOM. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. | 2024-12-10 | 5.4 | CVE-2024-43754 |
| n/a — n/a | IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 2024-12-10 | 5.4 | CVE-2024-47117 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52816 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52817 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52818 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script. | 2024-12-10 | 5.4 | CVE-2024-52822 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-52823 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52824 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52825 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52826 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52827 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52828 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52829 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52830 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52832 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52834 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52835 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52836 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input for the exploit to execute. | 2024-12-10 | 5.4 | CVE-2024-52837 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-52838 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-52839 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input the malicious data themselves. | 2024-12-10 | 5.4 | CVE-2024-52840 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52841 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52842 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52843 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. | 2024-12-10 | 5.4 | CVE-2024-52844 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52845 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52846 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52847 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52848 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52849 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52850 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52851 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52852 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52853 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52854 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52855 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52857 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52858 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52859 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim’s browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. User interaction is required for exploitation, as a victim must visit a malicious link or input data into a vulnerable web application. | 2024-12-10 | 5.4 | CVE-2024-52860 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52861 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52862 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52864 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52865 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52991 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52992 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-52993 |
| adobe — experience_manager | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-53960 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-54039 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-54040 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | 2024-12-10 | 5.4 | CVE-2024-54041 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54042 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54043 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54044 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54045 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54046 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54047 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. | 2024-12-10 | 5.4 | CVE-2024-54048 |
| lopalopa — e-learning_management_system | A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter. | 2024-12-09 | 5.4 | CVE-2024-54919 |
| lopalopa — e-learning_management_system | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter. | 2024-12-09 | 5.4 | CVE-2024-54935 |
| lopalopa — e-learning_management_system | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter. | 2024-12-09 | 5.4 | CVE-2024-54936 |
| n/a — n/a | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. | 2024-12-11 | 5.3 | CVE-2024-11008 |
| n/a — n/a | The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. | 2024-12-11 | 5.3 | CVE-2024-11351 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to download other users resumes. | 2024-12-14 | 5.3 | CVE-2024-11712 |
| n/a — n/a | The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation. | 2024-12-12 | 5.3 | CVE-2024-12265 |
| n/a — n/a | The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the ‘get_legacy_cookies’ function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts. | 2024-12-11 | 5.3 | CVE-2024-12294 |
| n/a — n/a | The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts. | 2024-12-13 | 5.3 | CVE-2024-12309 |
| mayurik — best_house_rental_management_system | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | 5.3 | CVE-2024-12357 |
| n/a — n/a | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the ‘tickera_tickets_info’ endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more. | 2024-12-14 | 5.3 | CVE-2024-12578 |
| n/a — n/a | The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages. | 2024-12-13 | 5.3 | CVE-2024-12579 |
| apple — ipados | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, visionOS 2.1, tvOS 18.1, iOS 18.1 and iPadOS 18.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin. | 2024-12-12 | 5.3 | CVE-2024-44212 |
| n/a — n/a | SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited. | 2024-12-10 | 5.3 | CVE-2024-45709 |
| lopalopa — e-learning_management_system | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/assets. | 2024-12-09 | 5.3 | CVE-2024-54937 |
| n/a — n/a | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user’s system or accessible network folders by injecting malicious data into the communication channel between the two systems. | 2024-12-10 | 5.1 | CVE-2024-54005 |
| apple — watchos | A race condition was addressed with improved locking. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to leak sensitive kernel state. | 2024-12-12 | 5.1 | CVE-2024-54510 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the ‘fieldfor’, ‘visibleParent’ and ‘id’ parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-14 | 4.9 | CVE-2024-11710 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the ‘page_id’ parameter of the wpjobportal_deactivate() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-14 | 4.9 | CVE-2024-11713 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the ‘ff’ parameter of the getFieldsForVisibleCombobox() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 2024-12-14 | 4.9 | CVE-2024-11714 |
| n/a — n/a | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer. | 2024-12-14 | 4.8 | CVE-2024-11715 |
| classcms — classcms | A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | 2024-12-12 | 4.8 | CVE-2024-12503 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 4.7 | CVE-2024-49531 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim’s browser. This issue occurs when data from a malicious source is processed by a web application’s client-side scripts to update the DOM. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. | 2024-12-10 | 4.6 | CVE-2024-43732 |
| n/a — n/a | Windows Mobile Broadband Driver Information Disclosure Vulnerability | 2024-12-12 | 4.6 | CVE-2024-49087 |
| n/a — n/a | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files. | 2024-12-10 | 4.6 | CVE-2024-53832 |
| n/a — n/a | The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s content settings for notifications in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | 2024-12-12 | 4.4 | CVE-2024-11727 |
| n/a — n/a | The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | 2024-12-12 | 4.4 | CVE-2024-12271 |
| n/a — n/a | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster. | 2024-12-12 | 4.4 | CVE-2024-12401 |
| n/a — n/a | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | 2024-12-13 | 4.4 | CVE-2024-12581 |
| n/a — n/a | The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cache-folder’ parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | 2024-12-14 | 4.4 | CVE-2024-12628 |
| n/a — n/a | IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user. | 2024-12-11 | 4.4 | CVE-2024-35117 |
| n/a — n/a | The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the ‘SHORTCODE_ELEMENTOR’ shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to. | 2024-12-14 | 4.3 | CVE-2024-10690 |
| n/a — n/a | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the ‘wp_reusable_render’ shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. | 2024-12-12 | 4.3 | CVE-2024-11181 |
| n/a — n/a | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users. | 2024-12-13 | 4.3 | CVE-2024-11275 |
| n/a — n/a | The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts. | 2024-12-12 | 4.3 | CVE-2024-11709 |
| n/a — n/a | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to whitelist scripts. | 2024-12-12 | 4.3 | CVE-2024-11724 |
| n/a — n/a | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement. | 2024-12-13 | 4.3 | CVE-2024-11911 |
| n/a — n/a | The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin’s Shortcodes. | 2024-12-12 | 4.3 | CVE-2024-12018 |
| n/a — n/a | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table. | 2024-12-12 | 4.3 | CVE-2024-12059 |
| n/a — n/a | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles. | 2024-12-12 | 4.3 | CVE-2024-12201 |
| n/a — n/a | The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely. | 2024-12-12 | 4.3 | CVE-2024-12263 |
| n/a — n/a | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs | 2024-12-12 | 4.3 | CVE-2024-12329 |
| n/a — n/a | The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘cf7cs_action_callback’ function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the content of any post and create new skins. | 2024-12-12 | 4.3 | CVE-2024-12341 |
| n/a — n/a | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the setting_page() function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-13 | 4.3 | CVE-2024-12414 |
| n/a — n/a | The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the ‘post-content’ shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the content of password-protected, private, draft, and pending posts. | 2024-12-14 | 4.3 | CVE-2024-12447 |
| cjbi — wetech-cms | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cms-master\wetech-basic-common\src\main\java\tech\wetech\basic\util\BackupFileUtil.java of the component Database Backup Handler. The manipulation of the argument name leads to path traversal: ‘../filedir’. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-12 | 4.3 | CVE-2024-12482 |
| n/a — n/a | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.0. This is due to missing or incorrect nonce validation on the ‘albfre_user_action’ AJAX action. This makes it possible for unauthenticated attackers to update the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | 2024-12-12 | 4.3 | CVE-2024-12526 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. | 2024-12-10 | 4.3 | CVE-2024-43716 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. | 2024-12-10 | 4.3 | CVE-2024-43717 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. | 2024-12-10 | 4.3 | CVE-2024-43731 |
| n/a — n/a | Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability | 2024-12-12 | 4.3 | CVE-2024-49098 |
| n/a — n/a | Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability | 2024-12-12 | 4.3 | CVE-2024-49099 |
| n/a — n/a | Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability | 2024-12-12 | 4.3 | CVE-2024-49103 |
| n/a — n/a | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. | 2024-12-11 | 4.3 | CVE-2024-51460 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. | 2024-12-10 | 4.3 | CVE-2024-54038 |
| n/a — n/a | A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker’s own session with the client with a victim’s identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack. | 2024-12-09 | 4.2 | CVE-2024-12369 |
| apple — ipados | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2. Muting a call while ringing may not result in mute being enabled. | 2024-12-12 | 4.2 | CVE-2024-54503 |
Low Vulnerabilities
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info |
|---|---|---|---|---|
| n/a — n/a | The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It’s important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited. | 2024-12-13 | 3.7 | CVE-2024-12300 |
| n/a — n/a | Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | 3.5 | CVE-2024-43755 |
| apple — ipados | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to read sensitive location information. | 2024-12-12 | 3.3 | CVE-2024-44200 |
| apple — ipados | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, watchOS 11.1. An app may be able to determine a user’s current location. | 2024-12-12 | 3.3 | CVE-2024-44290 |
| apple — macos | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicators for microphone access may be attributed incorrectly. | 2024-12-12 | 3.3 | CVE-2024-54493 |
| n/a — n/a | IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system. | 2024-12-11 | 3.1 | CVE-2023-23472 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. | 2024-12-10 | 3.1 | CVE-2024-54050 |
| n/a — n/a | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. | 2024-12-10 | 3.1 | CVE-2024-54051 |
| n/a — n/a | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. | 2024-12-11 | 2.5 | CVE-2023-37395 |
| apple — iphone_os | The issue was addressed by adding additional logic. This issue is fixed in iPadOS 17.7.3, iOS 18.2 and iPadOS 18.2. An attacker with physical access to an iOS device may be able to view notification content from the lock screen. | 2024-12-12 | 2.4 | CVE-2024-54485 |
Severity Not Yet Assigned
| Primary Vendor — Product | Description | Published | CVSS Score | Source Info |
|---|---|---|---|---|
| n/a — n/a | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The CLI feature in the web interface of affected devices is vulnerable to cross-site request forgery (CSRF). This could allow an attacker to read or modify the device configuration by tricking an authenticated legitimate user into accessing a malicious link. | 2024-12-10 | not yet calculated | CVE-2020-28398 |
| n/a — n/a | This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers. | 2024-12-13 | not yet calculated | CVE-2021-32007 |
| n/a — n/a | AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is, for example, used in certain ASUS devices. | 2024-12-09 | not yet calculated | CVE-2022-29974 |
| n/a — n/a | Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code. | 2024-12-09 | not yet calculated | CVE-2022-38946 |
| n/a — n/a | SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code. | 2024-12-09 | not yet calculated | CVE-2022-38947 |
| n/a — n/a | Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6. | 2024-12-13 | not yet calculated | CVE-2022-43472 |
| n/a — n/a | Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3. | 2024-12-13 | not yet calculated | CVE-2022-44578 |
| n/a — n/a | Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4. | 2024-12-13 | not yet calculated | CVE-2022-45806 |
| n/a — n/a | Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1. | 2024-12-13 | not yet calculated | CVE-2022-45819 |
| n/a — n/a | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13. | 2024-12-13 | not yet calculated | CVE-2022-45826 |
| n/a — n/a | Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5. | 2024-12-13 | not yet calculated | CVE-2022-45840 |
| n/a — n/a | Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9. | 2024-12-13 | not yet calculated | CVE-2022-45841 |
| n/a — n/a | Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2. | 2024-12-13 | not yet calculated | CVE-2022-46795 |
| n/a — n/a | Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.1.25. | 2024-12-13 | not yet calculated | CVE-2022-46796 |
| n/a — n/a | Missing Authorization vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Sync for WooCommerce: from n/a through 2.3.2. | 2024-12-13 | not yet calculated | CVE-2022-46807 |
| n/a — n/a | Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 1.0.21. | 2024-12-13 | not yet calculated | CVE-2022-46811 |
| n/a — n/a | Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1. | 2024-12-13 | not yet calculated | CVE-2022-46838 |
| n/a — n/a | Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1. | 2024-12-13 | not yet calculated | CVE-2022-46840 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through 1.5.7. | 2024-12-13 | not yet calculated | CVE-2022-46846 |
| n/a — n/a | Missing Authorization vulnerability in Printful Printful Integration for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through 2.2.3. | 2024-12-13 | not yet calculated | CVE-2022-47168 |
| n/a — n/a | Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0. | 2024-12-13 | not yet calculated | CVE-2022-47176 |
| n/a — n/a | Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1. | 2024-12-13 | not yet calculated | CVE-2022-47182 |
| n/a — n/a | Missing Authorization vulnerability in 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin allows Retrieve Embedded Sensitive Data.This issue affects Coming Soon Landing Page and Maintenance Mode WordPress Plugin: from n/a through 2.2.0. | 2024-12-13 | not yet calculated | CVE-2022-47429 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5. | 2024-12-13 | not yet calculated | CVE-2022-47594 |
| n/a — n/a | Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through 3.2.0. | 2024-12-13 | not yet calculated | CVE-2023-22697 |
| n/a — n/a | Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebook Store: from n/a through 5.775. | 2024-12-09 | not yet calculated | CVE-2023-22701 |
| n/a — n/a | Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7. | 2024-12-09 | not yet calculated | CVE-2023-22708 |
| n/a — n/a | Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2. | 2024-12-09 | not yet calculated | CVE-2023-23715 |
| n/a — n/a | Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4. | 2024-12-09 | not yet calculated | CVE-2023-23716 |
| n/a — n/a | Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46. | 2024-12-09 | not yet calculated | CVE-2023-23725 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0. | 2024-12-09 | not yet calculated | CVE-2023-23726 |
| n/a — n/a | Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13. | 2024-12-09 | not yet calculated | CVE-2023-23814 |
| n/a — n/a | Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8. | 2024-12-09 | not yet calculated | CVE-2023-23823 |
| n/a — n/a | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0. | 2024-12-09 | not yet calculated | CVE-2023-23825 |
| n/a — n/a | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0. | 2024-12-09 | not yet calculated | CVE-2023-23834 |
| n/a — n/a | Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6. | 2024-12-09 | not yet calculated | CVE-2023-23868 |
| n/a — n/a | Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7. | 2024-12-09 | not yet calculated | CVE-2023-23886 |
| n/a — n/a | Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0. | 2024-12-09 | not yet calculated | CVE-2023-23887 |
| n/a — n/a | Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0. | 2024-12-09 | not yet calculated | CVE-2023-23893 |
| n/a — n/a | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82. | 2024-12-09 | not yet calculated | CVE-2023-23895 |
| n/a — n/a | Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4. | 2024-12-09 | not yet calculated | CVE-2023-23975 |
| n/a — n/a | Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14. | 2024-12-09 | not yet calculated | CVE-2023-23986 |
| n/a — n/a | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14. | 2024-12-09 | not yet calculated | CVE-2023-24375 |
| n/a — n/a | Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3. | 2024-12-09 | not yet calculated | CVE-2023-24407 |
| n/a — n/a | Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2. | 2024-12-09 | not yet calculated | CVE-2023-25026 |
| n/a — n/a | Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1. | 2024-12-09 | not yet calculated | CVE-2023-25035 |
| n/a — n/a | Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34. | 2024-12-09 | not yet calculated | CVE-2023-25037 |
| n/a — n/a | Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from n/a through 2.6. | 2024-12-09 | not yet calculated | CVE-2023-25048 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2. | 2024-12-09 | not yet calculated | CVE-2023-25060 |
| n/a — n/a | Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects We’re Open!: from n/a through 1.45. | 2024-12-09 | not yet calculated | CVE-2023-25067 |
| n/a — n/a | Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5. | 2024-12-09 | not yet calculated | CVE-2023-25454 |
| n/a — n/a | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0. | 2024-12-09 | not yet calculated | CVE-2023-25455 |
| n/a — n/a | Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2. | 2024-12-09 | not yet calculated | CVE-2023-25469 |
| n/a — n/a | Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7. | 2024-12-09 | not yet calculated | CVE-2023-25486 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2. | 2024-12-09 | not yet calculated | CVE-2023-25703 |
| n/a — n/a | Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25. | 2024-12-09 | not yet calculated | CVE-2023-25714 |
| n/a — n/a | Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1. | 2024-12-09 | not yet calculated | CVE-2023-25791 |
| n/a — n/a | Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10. | 2024-12-09 | not yet calculated | CVE-2023-25959 |
| n/a — n/a | Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4. | 2024-12-09 | not yet calculated | CVE-2023-25966 |
| n/a — n/a | Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6. | 2024-12-13 | not yet calculated | CVE-2023-25988 |
| n/a — n/a | Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3. | 2024-12-09 | not yet calculated | CVE-2023-25993 |
| n/a — n/a | Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2. | 2024-12-09 | not yet calculated | CVE-2023-26520 |
| n/a — n/a | Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1. | 2024-12-09 | not yet calculated | CVE-2023-26522 |
| n/a — n/a | Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3. | 2024-12-09 | not yet calculated | CVE-2023-27428 |
| n/a — n/a | Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6. | 2024-12-09 | not yet calculated | CVE-2023-27449 |
| n/a — n/a | Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10. | 2024-12-09 | not yet calculated | CVE-2023-27454 |
| n/a — n/a | Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19. | 2024-12-13 | not yet calculated | CVE-2023-27456 |
| n/a — n/a | Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0. | 2024-12-09 | not yet calculated | CVE-2023-27625 |
| n/a — n/a | Missing Authorization vulnerability in Aleksandar Uroševic Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Ticker: from n/a through 3.23.0. | 2024-12-09 | not yet calculated | CVE-2023-27626 |
| n/a — n/a | Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28. | 2024-12-09 | not yet calculated | CVE-2023-28165 |
| n/a — n/a | Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9. | 2024-12-09 | not yet calculated | CVE-2023-28168 |
| n/a — n/a | Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5. | 2024-12-09 | not yet calculated | CVE-2023-28416 |
| n/a — n/a | Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12. | 2024-12-09 | not yet calculated | CVE-2023-28417 |
| n/a — n/a | Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5. | 2024-12-09 | not yet calculated | CVE-2023-28532 |
| n/a — n/a | Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0. | 2024-12-09 | not yet calculated | CVE-2023-28536 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7. | 2024-12-09 | not yet calculated | CVE-2023-28688 |
| n/a — n/a | Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0. | 2024-12-09 | not yet calculated | CVE-2023-28689 |
| n/a — n/a | Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9. | 2024-12-13 | not yet calculated | CVE-2023-28990 |
| n/a — n/a | Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5. | 2024-12-09 | not yet calculated | CVE-2023-29173 |
| n/a — n/a | Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5. | 2024-12-09 | not yet calculated | CVE-2023-29237 |
| n/a — n/a | Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1. | 2024-12-09 | not yet calculated | CVE-2023-29239 |
| n/a — n/a | Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13. | 2024-12-09 | not yet calculated | CVE-2023-29422 |
| n/a — n/a | Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1. | 2024-12-09 | not yet calculated | CVE-2023-29429 |
| n/a — n/a | Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1. | 2024-12-09 | not yet calculated | CVE-2023-29431 |
| n/a — n/a | Missing Authorization vulnerability in ??? tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7. | 2024-12-09 | not yet calculated | CVE-2023-29433 |
| n/a — n/a | In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. This is fixed in 2.88.2+, 2.89.1+, and 2.90.1+. | 2024-12-14 | not yet calculated | CVE-2023-29476 |
| n/a — n/a | Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2. | 2024-12-09 | not yet calculated | CVE-2023-30476 |
| n/a — n/a | Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.3.2. | 2024-12-09 | not yet calculated | CVE-2023-30479 |
| n/a — n/a | Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0. | 2024-12-09 | not yet calculated | CVE-2023-30486 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7. | 2024-12-09 | not yet calculated | CVE-2023-30488 |
| n/a — n/a | Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8. | 2024-12-13 | not yet calculated | CVE-2023-30490 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7. | 2024-12-09 | not yet calculated | CVE-2023-30748 |
| n/a — n/a | Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0. | 2024-12-09 | not yet calculated | CVE-2023-30783 |
| n/a — n/a | Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3. | 2024-12-09 | not yet calculated | CVE-2023-30870 |
| n/a — n/a | Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8. | 2024-12-09 | not yet calculated | CVE-2023-30873 |
| n/a — n/a | Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0. | 2024-12-09 | not yet calculated | CVE-2023-31073 |
| n/a — n/a | Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0. | 2024-12-09 | not yet calculated | CVE-2023-31214 |
| n/a — n/a | Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19. | 2024-12-09 | not yet calculated | CVE-2023-32094 |
| n/a — n/a | Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99. | 2024-12-09 | not yet calculated | CVE-2023-32117 |
| n/a — n/a | Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1. | 2024-12-09 | not yet calculated | CVE-2023-32126 |
| n/a — n/a | Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7. | 2024-12-09 | not yet calculated | CVE-2023-32293 |
| n/a — n/a | Missing Authorization vulnerability in anzia Ni WooCommerce Sales Report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through 3.7.3. | 2024-12-09 | not yet calculated | CVE-2023-32299 |
| n/a — n/a | Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3. | 2024-12-13 | not yet calculated | CVE-2023-32506 |
| n/a — n/a | Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2. | 2024-12-13 | not yet calculated | CVE-2023-32507 |
| n/a — n/a | Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0. | 2024-12-13 | not yet calculated | CVE-2023-32519 |
| n/a — n/a | Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0. | 2024-12-13 | not yet calculated | CVE-2023-32520 |
| n/a — n/a | Missing Authorization vulnerability in Fahad Mahmood Injection Guard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Injection Guard: from n/a through 1.2.1. | 2024-12-13 | not yet calculated | CVE-2023-32574 |
| n/a — n/a | Missing Authorization vulnerability in MobileMonkey WP-Chatbot for Messenger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Chatbot for Messenger: from n/a through 4.7. | 2024-12-13 | not yet calculated | CVE-2023-32581 |
| n/a — n/a | Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6. | 2024-12-13 | not yet calculated | CVE-2023-32585 |
| n/a — n/a | Missing Authorization vulnerability in Thomas Michalak Soundcloud Is Gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Soundcloud Is Gold: from n/a through 2.5.1. | 2024-12-13 | not yet calculated | CVE-2023-32586 |
| n/a — n/a | Missing Authorization vulnerability in GS Plugins GS Pins for Pinterest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Pins for Pinterest: from n/a through 1.6.7. | 2024-12-13 | not yet calculated | CVE-2023-32593 |
| n/a — n/a | Missing Authorization vulnerability in Bill Minozzi reCAPTCHA for all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects reCAPTCHA for all: from n/a through 1.22. | 2024-12-13 | not yet calculated | CVE-2023-32599 |
| n/a — n/a | Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12. | 2024-12-13 | not yet calculated | CVE-2023-32601 |
| n/a — n/a | Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0. | 2024-12-13 | not yet calculated | CVE-2023-32798 |
| n/a — n/a | Missing Authorization vulnerability in a3rev Software WooCommerce Predictive Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Predictive Search: from n/a through 5.8.0. | 2024-12-13 | not yet calculated | CVE-2023-32963 |
| n/a — n/a | Missing Authorization vulnerability in Tagbox Taggbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through 3.3. | 2024-12-13 | not yet calculated | CVE-2023-33215 |
| n/a — n/a | Missing Authorization vulnerability in wppal Easy Captcha allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Captcha: from n/a through 1.0. | 2024-12-13 | not yet calculated | CVE-2023-33324 |
| n/a — n/a | Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0. | 2024-12-13 | not yet calculated | CVE-2023-33928 |
| n/a — n/a | Missing Authorization vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slimstat Analytics: from n/a through 5.0.5.1. | 2024-12-13 | not yet calculated | CVE-2023-33994 |
| n/a — n/a | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15. | 2024-12-13 | not yet calculated | CVE-2023-33995 |
| n/a — n/a | Missing Authorization vulnerability in ?leanTalk – Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10. | 2024-12-13 | not yet calculated | CVE-2023-33996 |
| n/a — n/a | Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5. | 2024-12-13 | not yet calculated | CVE-2023-33998 |
| n/a — n/a | Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media & Share Icons: from n/a through 2.8.1. | 2024-12-13 | not yet calculated | CVE-2023-34009 |
| n/a — n/a | Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2. | 2024-12-13 | not yet calculated | CVE-2023-34014 |
| n/a — n/a | Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3. | 2024-12-13 | not yet calculated | CVE-2023-34019 |
| n/a — n/a | Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3. | 2024-12-13 | not yet calculated | CVE-2023-34376 |
| n/a — n/a | Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2. | 2024-12-13 | not yet calculated | CVE-2023-34381 |
| n/a — n/a | Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3. | 2024-12-13 | not yet calculated | CVE-2023-34387 |
| n/a — n/a | Missing Authorization vulnerability in Surfer Surfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.3.2.357. | 2024-12-13 | not yet calculated | CVE-2023-35037 |
| n/a — n/a | Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5. | 2024-12-13 | not yet calculated | CVE-2023-35046 |
| n/a — n/a | Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7. | 2024-12-13 | not yet calculated | CVE-2023-35051 |
| n/a — n/a | Missing Authorization vulnerability in wpWax – WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4. | 2024-12-13 | not yet calculated | CVE-2023-35052 |
| n/a — n/a | Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2. | 2024-12-13 | not yet calculated | CVE-2023-35777 |
| n/a — n/a | Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5. | 2024-12-13 | not yet calculated | CVE-2023-35875 |
| n/a — n/a | Missing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0. | 2024-12-13 | not yet calculated | CVE-2023-36506 |
| n/a — n/a | Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5. | 2024-12-13 | not yet calculated | CVE-2023-36509 |
| n/a — n/a | Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211. | 2024-12-13 | not yet calculated | CVE-2023-36510 |
| n/a — n/a | Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2. | 2024-12-13 | not yet calculated | CVE-2023-36518 |
| n/a — n/a | Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15. | 2024-12-13 | not yet calculated | CVE-2023-36519 |
| n/a — n/a | Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1. | 2024-12-13 | not yet calculated | CVE-2023-36526 |
| n/a — n/a | Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3. | 2024-12-13 | not yet calculated | CVE-2023-36528 |
| n/a — n/a | Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68. | 2024-12-13 | not yet calculated | CVE-2023-36531 |
| n/a — n/a | Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0. | 2024-12-13 | not yet calculated | CVE-2023-36680 |
| n/a — n/a | Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.2. | 2024-12-13 | not yet calculated | CVE-2023-36681 |
| n/a — n/a | Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.7. | 2024-12-13 | not yet calculated | CVE-2023-37887 |
| n/a — n/a | Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2. | 2024-12-13 | not yet calculated | CVE-2023-37967 |
| n/a — n/a | Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1. | 2024-12-13 | not yet calculated | CVE-2023-37969 |
| n/a — n/a | Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1. | 2024-12-13 | not yet calculated | CVE-2023-37971 |
| n/a — n/a | Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10. | 2024-12-13 | not yet calculated | CVE-2023-37984 |
| n/a — n/a | Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3. | 2024-12-13 | not yet calculated | CVE-2023-37987 |
| n/a — n/a | Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0. | 2024-12-13 | not yet calculated | CVE-2023-37989 |
| n/a — n/a | Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1. | 2024-12-13 | not yet calculated | CVE-2023-38383 |
| n/a — n/a | Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. | 2024-12-13 | not yet calculated | CVE-2023-38385 |
| n/a — n/a | Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12. | 2024-12-13 | not yet calculated | CVE-2023-38475 |
| n/a — n/a | Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0. | 2024-12-13 | not yet calculated | CVE-2023-38477 |
| n/a — n/a | Missing Authorization vulnerability in Codents Simple Googlebot Visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through 1.2.4. | 2024-12-13 | not yet calculated | CVE-2023-38479 |
| n/a — n/a | Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9. | 2024-12-13 | not yet calculated | CVE-2023-38480 |
| n/a — n/a | Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4. | 2024-12-13 | not yet calculated | CVE-2023-38483 |
| n/a — n/a | Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7. | 2024-12-13 | not yet calculated | CVE-2023-38514 |
| n/a — n/a | Missing Authorization vulnerability in YetAnotherStarsRating.com Yet Another Stars Rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through 3.4.3. | 2024-12-13 | not yet calculated | CVE-2023-39305 |
| n/a — n/a | Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through 2.9.2. | 2024-12-13 | not yet calculated | CVE-2023-39920 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7. | 2024-12-13 | not yet calculated | CVE-2023-39995 |
| n/a — n/a | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Accordion and Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion and Accordion Slider: from n/a through 1.2.4. | 2024-12-13 | not yet calculated | CVE-2023-39996 |
| n/a — n/a | Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19. | 2024-12-13 | not yet calculated | CVE-2023-39997 |
| n/a — n/a | Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13. | 2024-12-13 | not yet calculated | CVE-2023-40001 |
| n/a — n/a | Missing Authorization vulnerability in weDevs WP Project Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through 2.6.7. | 2024-12-13 | not yet calculated | CVE-2023-40003 |
| n/a — n/a | Missing Authorization vulnerability in Easy Digital Downloads Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.1.5. | 2024-12-13 | not yet calculated | CVE-2023-40005 |
| n/a — n/a | Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator Builder: from n/a through 3.1.42. | 2024-12-13 | not yet calculated | CVE-2023-40011 |
| n/a — n/a | Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4. | 2024-12-13 | not yet calculated | CVE-2023-40203 |
| n/a — n/a | Missing Authorization vulnerability in Mateusz Czardybon Justified Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justified Gallery: from n/a through 1.7.3. | 2024-12-13 | not yet calculated | CVE-2023-40213 |
| n/a — n/a | Missing Authorization vulnerability in bqworks Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider: from n/a through 1.9.6. | 2024-12-13 | not yet calculated | CVE-2023-40331 |
| n/a — n/a | Missing Authorization vulnerability in realmag777 HUSKY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through 1.3.4.2. | 2024-12-13 | not yet calculated | CVE-2023-40334 |
| n/a — n/a | Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17. | 2024-12-13 | not yet calculated | CVE-2023-40670 |
| n/a — n/a | Missing Authorization vulnerability in Lasso Simple URLs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through 117. | 2024-12-13 | not yet calculated | CVE-2023-40678 |
| n/a — n/a | Missing Authorization vulnerability in Premmerce Premmerce User Roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through 1.0.12. | 2024-12-13 | not yet calculated | CVE-2023-41130 |
| n/a — n/a | Missing Authorization vulnerability in ShapedPlugin LLC Category Slider for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Category Slider for WooCommerce: from n/a through 1.4.15. | 2024-12-13 | not yet calculated | CVE-2023-41132 |
| n/a — n/a | Authentication Bypass by Spoofing vulnerability in Michal Novák Secure Admin IP allows Functionality Bypass.This issue affects Secure Admin IP: from n/a through 2.0. | 2024-12-13 | not yet calculated | CVE-2023-41133 |
| n/a — n/a | Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1.1.2. | 2024-12-13 | not yet calculated | CVE-2023-41649 |
| n/a — n/a | Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a through 1.0.4. | 2024-12-13 | not yet calculated | CVE-2023-41664 |
| n/a — n/a | Missing Authorization vulnerability in Tyche Softwares Abandoned Cart Lite for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Cart Lite for WooCommerce: from n/a through 5.16.1. | 2024-12-13 | not yet calculated | CVE-2023-41671 |
| n/a — n/a | Missing Authorization vulnerability in Pechenki TelSender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TelSender: from n/a through 1.14.11. | 2024-12-13 | not yet calculated | CVE-2023-41683 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2. | 2024-12-13 | not yet calculated | CVE-2023-41686 |
| n/a — n/a | Missing Authorization vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through 1.5. | 2024-12-13 | not yet calculated | CVE-2023-41688 |
| n/a — n/a | Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14. | 2024-12-13 | not yet calculated | CVE-2023-41689 |
| n/a — n/a | Missing Authorization vulnerability in Wiser Notify WiserNotify Social Proof allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserNotify Social Proof: from n/a through 2.5. | 2024-12-13 | not yet calculated | CVE-2023-41690 |
| n/a — n/a | Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.0. | 2024-12-13 | not yet calculated | CVE-2023-41695 |
| n/a — n/a | Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54. | 2024-12-13 | not yet calculated | CVE-2023-41802 |
| n/a — n/a | Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0. | 2024-12-13 | not yet calculated | CVE-2023-41803 |
| n/a — n/a | Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2. | 2024-12-13 | not yet calculated | CVE-2023-41848 |
| n/a — n/a | Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0. | 2024-12-13 | not yet calculated | CVE-2023-41849 |
| n/a — n/a | Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14. | 2024-12-13 | not yet calculated | CVE-2023-41857 |
| n/a — n/a | Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0. | 2024-12-13 | not yet calculated | CVE-2023-41862 |
| n/a — n/a | Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6. | 2024-12-13 | not yet calculated | CVE-2023-41865 |
| n/a — n/a | Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3. | 2024-12-13 | not yet calculated | CVE-2023-41866 |
| n/a — n/a | Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4. | 2024-12-13 | not yet calculated | CVE-2023-41869 |
| n/a — n/a | Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5. | 2024-12-13 | not yet calculated | CVE-2023-41870 |
| n/a — n/a | Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4. | 2024-12-13 | not yet calculated | CVE-2023-41873 |
| n/a — n/a | Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6. | 2024-12-13 | not yet calculated | CVE-2023-41875 |
| n/a — n/a | Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14. | 2024-12-13 | not yet calculated | CVE-2023-41951 |
| n/a — n/a | Missing Authorization vulnerability in Contact Form – WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8. | 2024-12-13 | not yet calculated | CVE-2023-41952 |
| n/a — n/a | Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1. | 2024-12-09 | not yet calculated | CVE-2023-41953 |
| n/a — n/a | Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project name function in the project settings tab. | 2024-12-09 | not yet calculated | CVE-2023-43962 |
| n/a — n/a | Missing Authorization vulnerability in Inactive Logout Inactive Logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through 3.2.2. | 2024-12-13 | not yet calculated | CVE-2023-44142 |
| n/a — n/a | Missing Authorization vulnerability in Apasionados Comment Blacklist Updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through 1.1.0. | 2024-12-13 | not yet calculated | CVE-2023-44147 |
| n/a — n/a | Missing Authorization vulnerability in BeRocket Brands for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through 3.8.2.2. | 2024-12-13 | not yet calculated | CVE-2023-44149 |
| n/a — n/a | Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0. | 2024-12-09 | not yet calculated | CVE-2023-47694 |
| n/a — n/a | Missing Authorization vulnerability in Artisan Workshop Japanized For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through 2.6.4. | 2024-12-09 | not yet calculated | CVE-2023-47698 |
| n/a — n/a | Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6. | 2024-12-09 | not yet calculated | CVE-2023-47756 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0. | 2024-12-09 | not yet calculated | CVE-2023-47760 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through 2.0.7. | 2024-12-09 | not yet calculated | CVE-2023-47761 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper BetterDocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through 2.5.2. | 2024-12-09 | not yet calculated | CVE-2023-47762 |
| n/a — n/a | Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.31. | 2024-12-09 | not yet calculated | CVE-2023-47763 |
| n/a — n/a | Missing Authorization vulnerability in Metaphor Creations Ditty allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through 3.1.24. | 2024-12-09 | not yet calculated | CVE-2023-47764 |
| n/a — n/a | Missing Authorization vulnerability in miniOrange miniorange otp verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through 4.2.1. | 2024-12-09 | not yet calculated | CVE-2023-47776 |
| n/a — n/a | Missing Authorization vulnerability in EasyAzon EasyAzon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through 5.1.0. | 2024-12-09 | not yet calculated | CVE-2023-47780 |
| n/a — n/a | Missing Authorization vulnerability in acmethemes Acme Fix Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through 1.0.0. | 2024-12-09 | not yet calculated | CVE-2023-47793 |
| n/a — n/a | Missing Authorization vulnerability in Themewinter WPCafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 2.2.22. | 2024-12-09 | not yet calculated | CVE-2023-47805 |
| n/a — n/a | Missing Authorization vulnerability in CRUDLab WP Like Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Like Button: from n/a through 1.7.0. | 2024-12-09 | not yet calculated | CVE-2023-47820 |
| n/a — n/a | Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10. | 2024-12-09 | not yet calculated | CVE-2023-47822 |
| n/a — n/a | Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7. | 2024-12-09 | not yet calculated | CVE-2023-47823 |
| n/a — n/a | Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3. | 2024-12-09 | not yet calculated | CVE-2023-47826 |
| n/a — n/a | Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0. | 2024-12-09 | not yet calculated | CVE-2023-47830 |
| n/a — n/a | Missing Authorization vulnerability in searchiq SearchIQ allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through 4.4. | 2024-12-09 | not yet calculated | CVE-2023-47832 |
| n/a — n/a | Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through 2.3.0. | 2024-12-09 | not yet calculated | CVE-2023-47836 |
| n/a — n/a | Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through 2.4.1. | 2024-12-09 | not yet calculated | CVE-2023-47838 |
| n/a — n/a | Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.1. | 2024-12-09 | not yet calculated | CVE-2023-47841 |
| n/a — n/a | Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kurulusu A.S. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1. | 2024-12-09 | not yet calculated | CVE-2023-47847 |
| n/a — n/a | Missing Authorization vulnerability in blossomthemes BlossomThemes Email Newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.4. | 2024-12-09 | not yet calculated | CVE-2023-47849 |
| n/a — n/a | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5. | 2024-12-09 | not yet calculated | CVE-2023-47869 |
| n/a — n/a | Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6. | 2024-12-09 | not yet calculated | CVE-2023-47871 |
| n/a — n/a | Missing Authorization vulnerability in Mondial Relay WooCommerce – WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5. | 2024-12-09 | not yet calculated | CVE-2023-48274 |
| n/a — n/a | Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Progressive Web Apps: from n/a through 2.2.21. | 2024-12-09 | not yet calculated | CVE-2023-48277 |
| n/a — n/a | Missing Authorization vulnerability in Tips and Tricks HQ, wptipsntricks Stripe Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through 2.0.79. | 2024-12-09 | not yet calculated | CVE-2023-48286 |
| n/a — n/a | Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0. | 2024-12-09 | not yet calculated | CVE-2023-48287 |
| n/a — n/a | Missing Authorization vulnerability in Awesome Support Team Awesome Support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through 6.1.4. | 2024-12-09 | not yet calculated | CVE-2023-48324 |
| n/a — n/a | Missing Authorization vulnerability in Tech Banker Mail Bank – #1 Mail SMTP Plugin for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank – #1 Mail SMTP Plugin for WordPress: from n/a through 4.0.14. | 2024-12-09 | not yet calculated | CVE-2023-48332 |
| n/a — n/a | Missing Authorization vulnerability in Easy Social Feed Easy Social Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through 6.5.1. | 2024-12-09 | not yet calculated | CVE-2023-48740 |
| n/a — n/a | Missing Authorization vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.1.10. | 2024-12-09 | not yet calculated | CVE-2023-48750 |
| n/a — n/a | Missing Authorization vulnerability in Martin Gibson IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through n/a. | 2024-12-09 | not yet calculated | CVE-2023-48774 |
| n/a — n/a | Missing Authorization vulnerability in Thomas Scholl canvasio3D Light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects canvasio3D Light: from n/a through 2.5.0. | 2024-12-09 | not yet calculated | CVE-2023-48776 |
| n/a — n/a | Missing Authorization vulnerability in 360 Javascript Viewer 360 Javascript Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through 1.7.11. | 2024-12-09 | not yet calculated | CVE-2023-48779 |
| n/a — n/a | Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8. | 2024-12-09 | not yet calculated | CVE-2023-49154 |
| n/a — n/a | Missing Authorization vulnerability in GoDaddy GoDaddy Email Marketing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDaddy Email Marketing: from n/a through 1.4.3. | 2024-12-09 | not yet calculated | CVE-2023-49156 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in LadiPage LadiApp allows Stored XSS.This issue affects LadiApp: from n/a through 4.4. | 2024-12-09 | not yet calculated | CVE-2023-49158 |
| n/a — n/a | Missing Authorization vulnerability in Code4Life Database for CF7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/a through 1.2.4. | 2024-12-09 | not yet calculated | CVE-2023-49167 |
| n/a — n/a | Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.6.3. | 2024-12-09 | not yet calculated | CVE-2023-49192 |
| n/a — n/a | Missing Authorization vulnerability in NerdPress Social Pug allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Pug: from n/a through 1.30.0. | 2024-12-09 | not yet calculated | CVE-2023-49193 |
| n/a — n/a | Insertion of Sensitive Information Into Debugging Code vulnerability in Importify Importify (Dropshipping WooCommerce) allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through 1.0.4. | 2024-12-09 | not yet calculated | CVE-2023-49194 |
| n/a — n/a | Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7. | 2024-12-09 | not yet calculated | CVE-2023-49196 |
| n/a — n/a | Missing Authorization vulnerability in Yogesh Pawar, Clarion Technologies Bulk Edit Post Titles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Edit Post Titles: from n/a through 5.0.0. | 2024-12-09 | not yet calculated | CVE-2023-49754 |
| n/a — n/a | Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2. | 2024-12-09 | not yet calculated | CVE-2023-49755 |
| n/a — n/a | Missing Authorization vulnerability in Themewinter Eventin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through 3.3.52. | 2024-12-09 | not yet calculated | CVE-2023-49756 |
| n/a — n/a | Missing Authorization vulnerability in Awesome Support Team Awesome Support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through 6.1.10. | 2024-12-09 | not yet calculated | CVE-2023-49757 |
| n/a — n/a | Missing Authorization vulnerability in Veribo, Roland Murg WP Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Booking System: from n/a through 2.0.19.2. | 2024-12-09 | not yet calculated | CVE-2023-49758 |
| n/a — n/a | Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1. | 2024-12-09 | not yet calculated | CVE-2023-49817 |
| n/a — n/a | Missing Authorization vulnerability in Webflow Webflow Pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webflow Pages: from n/a through 1.0.8. | 2024-12-09 | not yet calculated | CVE-2023-49818 |
| n/a — n/a | Missing Authorization vulnerability in Metagauss User Registration Forms RegistrationMagic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through 5.2.3.0. | 2024-12-09 | not yet calculated | CVE-2023-49831 |
| n/a — n/a | Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.10.2. | 2024-12-09 | not yet calculated | CVE-2023-49832 |
| n/a — n/a | Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31. | 2024-12-09 | not yet calculated | CVE-2023-49835 |
| n/a — n/a | Missing Authorization vulnerability in Loud Dog Redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through 1.2.1. | 2024-12-09 | not yet calculated | CVE-2023-49845 |
| n/a — n/a | Missing Authorization vulnerability in wooproductimporter Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1. | 2024-12-09 | not yet calculated | CVE-2023-49848 |
| n/a — n/a | Missing Authorization vulnerability in Aakash Chakravarthy Shortcoder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcoder: from n/a through 6.3. | 2024-12-09 | not yet calculated | CVE-2023-49849 |
| n/a — n/a | Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through 2.7. | 2024-12-09 | not yet calculated | CVE-2023-49850 |
| n/a — n/a | Missing Authorization vulnerability in ILMDESIGNS Square Thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square Thumbnails: from n/a through 1.1.1. | 2024-12-09 | not yet calculated | CVE-2023-49851 |
| n/a — n/a | Missing Authorization vulnerability in RedNao Smart Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through 2.6.84. | 2024-12-09 | not yet calculated | CVE-2023-49856 |
| n/a — n/a | Missing Authorization vulnerability in Awesome Support Team Awesome Support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through 6.1.7. | 2024-12-09 | not yet calculated | CVE-2023-49857 |
| n/a — n/a | Missing Authorization vulnerability in Austin Passy Custom Login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login: from n/a through 4.1.0. | 2024-12-09 | not yet calculated | CVE-2023-49858 |
| n/a — n/a | Missing Authorization vulnerability in Pixelite Login With Ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through 4.1. | 2024-12-09 | not yet calculated | CVE-2023-49859 |
| n/a — n/a | Missing Authorization vulnerability in socialmediafeather Social Media Feather allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media Feather: from n/a through 2.1.3. | 2024-12-09 | not yet calculated | CVE-2023-49861 |
| n/a — n/a | Missing Authorization vulnerability in WPSAAD Alt Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through 1.6.1. | 2024-12-09 | not yet calculated | CVE-2023-50373 |
| n/a — n/a | Missing Authorization vulnerability in Translate AI Multilingual Solutions Google Language Translator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Language Translator: from n/a through 6.0.19. | 2024-12-09 | not yet calculated | CVE-2023-50375 |
| n/a — n/a | Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3. | 2024-12-09 | not yet calculated | CVE-2023-50876 |
| n/a — n/a | Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0. | 2024-12-09 | not yet calculated | CVE-2023-50877 |
| n/a — n/a | Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.13.2. | 2024-12-09 | not yet calculated | CVE-2023-50882 |
| n/a — n/a | Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.1.5. | 2024-12-09 | not yet calculated | CVE-2023-50884 |
| n/a — n/a | Missing Authorization vulnerability in UserFeedback Team User Feedback allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through 1.0.10. | 2024-12-09 | not yet calculated | CVE-2023-50887 |
| n/a — n/a | Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2. | 2024-12-09 | not yet calculated | CVE-2023-50899 |
| n/a — n/a | Missing Authorization vulnerability in Wpmet Metform Elementor Contact Form Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform Elementor Contact Form Builder: from n/a through 3.4.0. | 2024-12-09 | not yet calculated | CVE-2023-50903 |
| n/a — n/a | Missing Authorization vulnerability in Poll Maker Team Poll Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through 4.8.0. | 2024-12-09 | not yet calculated | CVE-2023-50904 |
| n/a — n/a | Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19. | 2024-12-09 | not yet calculated | CVE-2023-51353 |
| n/a — n/a | Missing Authorization vulnerability in MultiVendorX WC Marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Marketplace: from n/a through 4.0.23. | 2024-12-09 | not yet calculated | CVE-2023-51355 |
| n/a — n/a | Missing Authorization vulnerability in Conversios Conversios.io allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through 6.5.0. | 2024-12-09 | not yet calculated | CVE-2023-51357 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0. | 2024-12-09 | not yet calculated | CVE-2023-51359 |
| n/a — n/a | Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0. | 2024-12-09 | not yet calculated | CVE-2023-51360 |
| n/a — n/a | Missing Authorization vulnerability in Premio All-in-one Floating Contact Form – My Sticky Elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All-in-one Floating Contact Form – My Sticky Elements: from n/a through 2.1.3. | 2024-12-09 | not yet calculated | CVE-2023-51362 |
| n/a — n/a | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | 2024-12-09 | not yet calculated | CVE-2023-7298 |
| n/a — n/a | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-10010 |
| n/a — n/a | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure. | 2024-12-12 | not yet calculated | CVE-2024-10043 |
| n/a — n/a | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. | 2024-12-10 | not yet calculated | CVE-2024-10256 |
| n/a — n/a | An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. | 2024-12-10 | not yet calculated | CVE-2024-10494 |
| n/a — n/a | An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. | 2024-12-10 | not yet calculated | CVE-2024-10495 |
| n/a — n/a | An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. | 2024-12-10 | not yet calculated | CVE-2024-10496 |
| n/a — n/a | The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks | 2024-12-12 | not yet calculated | CVE-2024-10499 |
| n/a — n/a | CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL. | 2024-12-11 | not yet calculated | CVE-2024-10511 |
| n/a — n/a | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-10517 |
| n/a — n/a | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-10518 |
| n/a — n/a | The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-10568 |
| n/a — n/a | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | 2024-12-12 | not yet calculated | CVE-2024-10637 |
| n/a — n/a | The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | 2024-12-13 | not yet calculated | CVE-2024-10678 |
| n/a — n/a | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server | 2024-12-10 | not yet calculated | CVE-2024-10708 |
| n/a — n/a | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-13 | not yet calculated | CVE-2024-10939 |
| n/a — n/a | The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 2024-12-10 | not yet calculated | CVE-2024-10959 |
| n/a — n/a | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. | 2024-12-11 | not yet calculated | CVE-2024-11053 |
| n/a — n/a | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. | 2024-12-10 | not yet calculated | CVE-2024-11106 |
| n/a — n/a | The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. | 2024-12-10 | not yet calculated | CVE-2024-11107 |
| n/a — n/a | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak. | 2024-12-09 | not yet calculated | CVE-2024-11268 |
| n/a — n/a | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration. | 2024-12-12 | not yet calculated | CVE-2024-11274 |
| n/a — n/a | Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform’s User Interface). This vulnerability has been fixed as of November 13th 2024. | 2024-12-11 | not yet calculated | CVE-2024-11401 |
| n/a — n/a | A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized. | 2024-12-09 | not yet calculated | CVE-2024-11454 |
| n/a — n/a | Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation. | 2024-12-11 | not yet calculated | CVE-2024-11597 |
| n/a — n/a | Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation. | 2024-12-11 | not yet calculated | CVE-2024-11598 |
| n/a — n/a | A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. | 2024-12-09 | not yet calculated | CVE-2024-11608 |
| n/a — n/a | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution | 2024-12-10 | not yet calculated | CVE-2024-11633 |
| n/a — n/a | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx) | 2024-12-10 | not yet calculated | CVE-2024-11634 |
| n/a — n/a | An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access | 2024-12-10 | not yet calculated | CVE-2024-11639 |
| n/a — n/a | CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device. | 2024-12-11 | not yet calculated | CVE-2024-11737 |
| n/a — n/a | Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | 2024-12-10 | not yet calculated | CVE-2024-11772 |
| n/a — n/a | SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. | 2024-12-10 | not yet calculated | CVE-2024-11773 |
| n/a — n/a | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11833 |
| n/a — n/a | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11834 |
| n/a — n/a | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11835 |
| n/a — n/a | Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11836 |
| n/a — n/a | Improper Neutralization of Special Elements used in an N1QL Command (‘N1QL Injection’) vulnerability in PlexTrac allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11837 |
| n/a — n/a | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11838 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. | 2024-12-13 | not yet calculated | CVE-2024-11839 |
| n/a — n/a | A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing? | 2024-12-15 | not yet calculated | CVE-2024-11858 |
| n/a — n/a | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material. | 2024-12-10 | not yet calculated | CVE-2024-11868 |
| n/a — n/a | Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Epic Games Launcher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The product applies incorrect default permissions to a sensitive folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24329. | 2024-12-12 | not yet calculated | CVE-2024-11872 |
| n/a — n/a | XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of XnSoft XnView Classic. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RWZ files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22913. | 2024-12-12 | not yet calculated | CVE-2024-11950 |
| n/a — n/a | Improper input handling in the ‘Host Header’ allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application’s standard functionality, it enables the execution of the payload, resulting in Stored XSS or ‘Cross-Site Scripting’. | 2024-12-13 | not yet calculated | CVE-2024-11986 |
| n/a — n/a | Motoko’s incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister’s memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko. | 2024-12-09 | not yet calculated | CVE-2024-11991 |
| n/a — n/a | User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application. | 2024-12-09 | not yet calculated | CVE-2024-12057 |
| n/a — n/a | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server. | 2024-12-09 | not yet calculated | CVE-2024-12174 |
| n/a — n/a | The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code. | 2024-12-13 | not yet calculated | CVE-2024-12212 |
| n/a — n/a | A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected. | 2024-12-10 | not yet calculated | CVE-2024-12236 |
| n/a — n/a | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers to extract configuration information that can be leveraged in another attack. | 2024-12-12 | not yet calculated | CVE-2024-12255 |
| n/a — n/a | MOBATIME Network Master Clock – DTS 4801 allows attackers to use SSH to gain initial access using default credentials. | 2024-12-10 | not yet calculated | CVE-2024-12286 |
| n/a — n/a | Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2. | 2024-12-12 | not yet calculated | CVE-2024-12289 |
| n/a — n/a | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs. | 2024-12-12 | not yet calculated | CVE-2024-12292 |
| n/a — n/a | An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available. | 2024-12-09 | not yet calculated | CVE-2024-12305 |
| n/a — n/a | Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available. | 2024-12-09 | not yet calculated | CVE-2024-12306 |
| n/a — n/a | A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the student editing functionality. At the time of publication of the CVE no patch is available. | 2024-12-09 | not yet calculated | CVE-2024-12307 |
| n/a — n/a | A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_cv_manager. The manipulation of the argument redirect_url leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The provided PoC only works in Mozilla Firefox. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-09 | not yet calculated | CVE-2024-12346 |
| n/a — n/a | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 2024-12-09 | not yet calculated | CVE-2024-12347 |
| n/a — n/a | A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | 2024-12-09 | not yet calculated | CVE-2024-12348 |
| n/a — n/a | Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management. | 2024-12-11 | not yet calculated | CVE-2024-12363 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 2024-12-10 | not yet calculated | CVE-2024-12393 |
| n/a — n/a | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | 2024-12-12 | not yet calculated | CVE-2024-12490 |
| n/a — n/a | Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within WTabletServicePro.exe. By creating a symbolic link, an attacker can abuse the service to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25359. | 2024-12-13 | not yet calculated | CVE-2024-12552 |
| n/a — n/a | GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394. | 2024-12-13 | not yet calculated | CVE-2024-12553 |
| n/a — n/a | Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation. | 2024-12-12 | not yet calculated | CVE-2024-12564 |
| n/a — n/a | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim’s `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim. | 2024-12-12 | not yet calculated | CVE-2024-12570 |
| n/a — n/a | A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. | 2024-12-13 | not yet calculated | CVE-2024-12603 |
| n/a — n/a | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function. | 2024-12-10 | not yet calculated | CVE-2024-21542 |
| n/a — n/a | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS. | 2024-12-13 | not yet calculated | CVE-2024-21543 |
| n/a — n/a | Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server. | 2024-12-13 | not yet calculated | CVE-2024-21544 |
| n/a — n/a | The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server. | 2024-12-12 | not yet calculated | CVE-2024-21574 |
| n/a — n/a | ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE). | 2024-12-12 | not yet calculated | CVE-2024-21575 |
| n/a — n/a | ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server. | 2024-12-13 | not yet calculated | CVE-2024-21576 |
| n/a — n/a | ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server. | 2024-12-13 | not yet calculated | CVE-2024-21577 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of complete system. | 2024-12-13 | not yet calculated | CVE-2024-22461 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local attacker could potentially exploit this vulnerability leading to gaining access to unauthorized data for a limited time. | 2024-12-13 | not yet calculated | CVE-2024-24902 |
| n/a — n/a | An unauthenticated attacker with network access to the affected device’s web interface can execute any system command via the “msg_events.php” script as the www-data user. The HTTP GET parameter “data” is not properly sanitized. | 2024-12-10 | not yet calculated | CVE-2024-28138 |
| n/a — n/a | The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won’t be fixed in the near future. | 2024-12-11 | not yet calculated | CVE-2024-28139 |
| n/a — n/a | The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running “ps aux” as the root user and observing the output. | 2024-12-11 | not yet calculated | CVE-2024-28140 |
| n/a — n/a | The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users. | 2024-12-11 | not yet calculated | CVE-2024-28141 |
| n/a — n/a | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The “File Name” page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the “file name” and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the “Default” User can be changed. | 2024-12-12 | not yet calculated | CVE-2024-28142 |
| n/a — n/a | The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue. | 2024-12-12 | not yet calculated | CVE-2024-28143 |
| n/a — n/a | An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user. | 2024-12-12 | not yet calculated | CVE-2024-28144 |
| n/a — n/a | An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter “field” with the UNION keyword. | 2024-12-12 | not yet calculated | CVE-2024-28145 |
| n/a — n/a | The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device. | 2024-12-12 | not yet calculated | CVE-2024-28146 |
| n/a — n/a | Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | 2024-12-13 | not yet calculated | CVE-2024-28980 |
| n/a — n/a | rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bin/format/mach0/dyldcache.c. | 2024-12-12 | not yet calculated | CVE-2024-31670 |
| n/a — n/a | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application. | 2024-12-10 | not yet calculated | CVE-2024-32732 |
| n/a — n/a | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts. | 2024-12-12 | not yet calculated | CVE-2024-36494 |
| n/a — n/a | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The “Edit Disclaimer Text” function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again. | 2024-12-12 | not yet calculated | CVE-2024-36498 |
| n/a — n/a | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Improper Link Resolution Before File Access vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to execute arbitrary code on the system. | 2024-12-10 | not yet calculated | CVE-2024-37143 |
| n/a — n/a | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster. | 2024-12-10 | not yet calculated | CVE-2024-37144 |
| n/a — n/a | A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. | 2024-12-12 | not yet calculated | CVE-2024-37377 |
| n/a — n/a | An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service. | 2024-12-12 | not yet calculated | CVE-2024-37401 |
| n/a — n/a | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 2024-12-09 | not yet calculated | CVE-2024-38485 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary attack against the RecoverPoint login form and a complete system compromise. This allows attackers to brute-force the password of valid users in an automated manner. | 2024-12-13 | not yet calculated | CVE-2024-38488 |
| n/a — n/a | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. | 2024-12-09 | not yet calculated | CVE-2024-40582 |
| n/a — n/a | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. | 2024-12-09 | not yet calculated | CVE-2024-40583 |
| n/a — n/a | Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected devices, require a device reboot to resolve. This issue affects: Controller 6000 and Controller 7000 firmware versions 9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4)), 9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5)), 8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6)), all versions of 8.80 and prior. | 2024-12-12 | not yet calculated | CVE-2024-41146 |
| n/a — n/a | Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to 9.10.2149 (MR4), 9.00 prior to 9.00.2374 (MR5), 8.90 prior to 8.90.2356 (MR6), all versions of 8.80 and prior. | 2024-12-12 | not yet calculated | CVE-2024-42407 |
| n/a — n/a | Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potentially exploit this vulnerability, leading to denial of service. | 2024-12-09 | not yet calculated | CVE-2024-42426 |
| n/a — n/a | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine. | 2024-12-12 | not yet calculated | CVE-2024-42448 |
| n/a — n/a | Missing Authorization vulnerability in Envato Security Team Sweet Date.This issue affects Sweet Date: from n/a through 3.7.3. | 2024-12-09 | not yet calculated | CVE-2024-43222 |
| n/a — n/a | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination. | 2024-12-12 | not yet calculated | CVE-2024-44220 |
| n/a — n/a | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. A malicious app may be able to gain root privileges. | 2024-12-12 | not yet calculated | CVE-2024-44224 |
| n/a — n/a | A logic issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to gain elevated privileges. | 2024-12-12 | not yet calculated | CVE-2024-44225 |
| n/a — n/a | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware. | 2024-12-12 | not yet calculated | CVE-2024-44241 |
| n/a — n/a | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware. | 2024-12-12 | not yet calculated | CVE-2024-44242 |
| n/a — n/a | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2. An app may be able to modify protected parts of the file system. | 2024-12-12 | not yet calculated | CVE-2024-44243 |
| n/a — n/a | The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, visionOS 2.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Sonoma 14.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory. | 2024-12-12 | not yet calculated | CVE-2024-44245 |
| n/a — n/a | The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, Safari 18.2, iPadOS 17.7.3. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website. | 2024-12-12 | not yet calculated | CVE-2024-44246 |
| n/a — n/a | Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that “A call to this function does not guarantee that the key offered is in fact used to authenticate.” Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry…@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. | 2024-12-12 | not yet calculated | CVE-2024-45337 |
| n/a — n/a | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available. | 2024-12-12 | not yet calculated | CVE-2024-45404 |
| n/a — n/a | An issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build revisions before 7.0.0. The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password). | 2024-12-10 | not yet calculated | CVE-2024-45493 |
| n/a — n/a | An issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build revisions before 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected firmware versions. | 2024-12-10 | not yet calculated | CVE-2024-45494 |
| n/a — n/a | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potentially exploit this vulnerability via the HTTP GET method leading to unauthorized action with elevated privileges. | 2024-12-09 | not yet calculated | CVE-2024-45760 |
| n/a — n/a | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Denial of Service. | 2024-12-09 | not yet calculated | CVE-2024-45761 |
| n/a — n/a | TP-Link TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset. | 2024-12-10 | not yet calculated | CVE-2024-46340 |
| n/a — n/a | TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-the-middle attack. | 2024-12-10 | not yet calculated | CVE-2024-46341 |
| n/a — n/a | An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. | 2024-12-10 | not yet calculated | CVE-2024-46442 |
| n/a — n/a | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. | 2024-12-09 | not yet calculated | CVE-2024-46455 |
| n/a — n/a | A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks. | 2024-12-09 | not yet calculated | CVE-2024-46547 |
| n/a — n/a | Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. | 2024-12-10 | not yet calculated | CVE-2024-46657 |
| n/a — n/a | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected. | 2024-12-09 | not yet calculated | CVE-2024-46901 |
| n/a — n/a | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. | 2024-12-13 | not yet calculated | CVE-2024-46971 |
| n/a — n/a | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution. | 2024-12-12 | not yet calculated | CVE-2024-47238 |
| n/a — n/a | Dell Avamar, version(s) 19.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | 2024-12-10 | not yet calculated | CVE-2024-47484 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47537 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47538 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 < ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop’s expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47539 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47540 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47543 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47544 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47545 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length – 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47546 |
| n/a — n/a | SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application. | 2024-12-10 | not yet calculated | CVE-2024-47576 |
| n/a — n/a | Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked. | 2024-12-10 | not yet calculated | CVE-2024-47577 |
| n/a — n/a | Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable. | 2024-12-10 | not yet calculated | CVE-2024-47578 |
| n/a — n/a | An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability | 2024-12-10 | not yet calculated | CVE-2024-47579 |
| n/a — n/a | An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability. | 2024-12-10 | not yet calculated | CVE-2024-47580 |
| n/a — n/a | SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted. | 2024-12-10 | not yet calculated | CVE-2024-47581 |
| n/a — n/a | Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application. | 2024-12-10 | not yet calculated | CVE-2024-47582 |
| n/a — n/a | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality. | 2024-12-10 | not yet calculated | CVE-2024-47585 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validation. If seqh_size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47596 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47597 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47598 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47599 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47600 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47601 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47602 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values. If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47603 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the ‘slice_size’ variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47606 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c’. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47607 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47613 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47615 |
| n/a — n/a | GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue. | 2024-12-11 | not yet calculated | CVE-2024-47758 |
| n/a — n/a | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue. | 2024-12-11 | not yet calculated | CVE-2024-47760 |
| n/a — n/a | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue. | 2024-12-11 | not yet calculated | CVE-2024-47761 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF – 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47774 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multiple GST_READ_UINT32_LE operations without performing boundary checks. This can lead to an OOB-read when buf is smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47775 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47776 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47777 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47778 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47834 |
| n/a — n/a | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ‘]’ in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ‘]’, strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10. | 2024-12-12 | not yet calculated | CVE-2024-47835 |
| n/a — n/a | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. | 2024-12-13 | not yet calculated | CVE-2024-47892 |
| n/a — n/a | If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as “www-data”. | 2024-12-10 | not yet calculated | CVE-2024-47946 |
| n/a — n/a | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The “Edit Disclaimer Text” function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. | 2024-12-12 | not yet calculated | CVE-2024-47947 |
| n/a — n/a | Dell Avamar, version(s) 19.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | 2024-12-10 | not yet calculated | CVE-2024-47977 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could potentially exploit this vulnerability, leading to the disruption of most functionalities of the RPA persistent after reboot, resulting in need of technical support intervention in getting system back to stable state. | 2024-12-13 | not yet calculated | CVE-2024-47984 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these secrets and reusing them to access the system leading to gaining access to unauthorized data. | 2024-12-13 | not yet calculated | CVE-2024-48007 |
| n/a — n/a | Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vulnerability leading to information disclosure ,allowing of unintended actions like reading files that may contain sensitive information | 2024-12-13 | not yet calculated | CVE-2024-48008 |
| n/a — n/a | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue. | 2024-12-11 | not yet calculated | CVE-2024-48912 |
| n/a — n/a | Serviceware Processes 6.0 through 7.3 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote code execution. | 2024-12-09 | not yet calculated | CVE-2024-48956 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | not yet calculated | CVE-2024-49532 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | not yet calculated | CVE-2024-49533 |
| n/a — n/a | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 2024-12-10 | not yet calculated | CVE-2024-49534 |
| n/a — n/a | Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges. | 2024-12-09 | not yet calculated | CVE-2024-49600 |
| n/a — n/a | Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service. | 2024-12-09 | not yet calculated | CVE-2024-49602 |
| n/a — n/a | Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could potentially exploit this vulnerability, leading to information disclosure. | 2024-12-09 | not yet calculated | CVE-2024-49603 |
| n/a — n/a | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue. | 2024-12-12 | not yet calculated | CVE-2024-50339 |
| n/a — n/a | An authenticated attacker with the user/role “Poweruser” can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET parameters. The “templates” parameter is vulnerable against blind boolean-based SQL injection attacks. SQL syntax must be injected into the JSON syntax of the templates parameter. | 2024-12-12 | not yet calculated | CVE-2024-50584 |
| n/a — n/a | Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the “Numerix License Server Administration System Login” (nlslogin.jsp) page. The vulnerability can be triggered by sending a specially crafted HTTP POST request. The vendor was unresponsive during multiple attempts to contact them via various channels, hence there is no solution available. In case you are using this software, be sure to restrict access and monitor logs. Try to reach out to your contact person for this vendor and request a patch. | 2024-12-11 | not yet calculated | CVE-2024-50585 |
| n/a — n/a | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities. | 2024-12-09 | not yet calculated | CVE-2024-50625 |
| n/a — n/a | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area network to manipulate URLs to include traversal sequences, potentially leading to unauthorized access to data. | 2024-12-09 | not yet calculated | CVE-2024-50626 |
| n/a — n/a | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malicious files, potentially leading to unauthorized system access. | 2024-12-09 | not yet calculated | CVE-2024-50627 |
| n/a — n/a | An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized manipulation of resources, which may lead to remote code execution when combined with other issues. | 2024-12-09 | not yet calculated | CVE-2024-50628 |
| n/a — n/a | TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator account. | 2024-12-10 | not yet calculated | CVE-2024-50699 |
| n/a — n/a | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. | 2024-12-10 | not yet calculated | CVE-2024-50920 |
| n/a — n/a | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller. | 2024-12-10 | not yet calculated | CVE-2024-50921 |
| n/a — n/a | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller. | 2024-12-10 | not yet calculated | CVE-2024-50924 |
| n/a — n/a | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device’s communications with the controller. | 2024-12-10 | not yet calculated | CVE-2024-50928 |
| n/a — n/a | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller’s memory, leading to a Denial of Service (DoS). | 2024-12-10 | not yet calculated | CVE-2024-50929 |
| n/a — n/a | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. | 2024-12-10 | not yet calculated | CVE-2024-50930 |
| n/a — n/a | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. | 2024-12-10 | not yet calculated | CVE-2024-50931 |
| n/a — n/a | SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB. | 2024-12-10 | not yet calculated | CVE-2024-51165 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.*, from 5.2.0 before 5.3.*. | 2024-12-13 | not yet calculated | CVE-2024-52057 |
| n/a — n/a | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.19. | 2024-12-13 | not yet calculated | CVE-2024-52058 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.17. | 2024-12-13 | not yet calculated | CVE-2024-52059 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45. | 2024-12-13 | not yet calculated | CVE-2024-52060 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. | 2024-12-13 | not yet calculated | CVE-2024-52061 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. | 2024-12-13 | not yet calculated | CVE-2024-52062 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. | 2024-12-13 | not yet calculated | CVE-2024-52063 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45. | 2024-12-13 | not yet calculated | CVE-2024-52064 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41. | 2024-12-13 | not yet calculated | CVE-2024-52065 |
| n/a — n/a | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40. | 2024-12-13 | not yet calculated | CVE-2024-52066 |
| n/a — n/a | Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerability in Sk. Abul Hasan Team Member.This issue affects Team Member: from n/a through 7.3. | 2024-12-09 | not yet calculated | CVE-2024-52385 |
| n/a — n/a | Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. | 2024-12-09 | not yet calculated | CVE-2024-52391 |
| n/a — n/a | Missing Authorization vulnerability in Astoundify Jobify – Job Board WordPress Theme.This issue affects Jobify – Job Board WordPress Theme: from n/a through 4.2.3. | 2024-12-09 | not yet calculated | CVE-2024-52480 |
| n/a — n/a | Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | 2024-12-11 | not yet calculated | CVE-2024-52537 |
| n/a — n/a | Dell Avamar, version(s) 19.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | 2024-12-10 | not yet calculated | CVE-2024-52538 |
| n/a — n/a | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW’s built-in multifactor authentication mechanism. An attacker who can authenticate locally (by knowing or guessing the password of a user) can thus log in regardless of MFA requirements. This does not affect MFA that are performed by single sign-on services. Users are advised to upgrade to at least version 5.1.9 to receive a fix. | 2024-12-09 | not yet calculated | CVE-2024-52586 |
| n/a — n/a | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix. | 2024-12-09 | not yet calculated | CVE-2024-52599 |
| n/a — n/a | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin” or “power” Splunk roles could see alert search query responses using Splunk Secure Gateway App Key Value Store (KVstore) collections endpoints due to improper access control. | 2024-12-10 | not yet calculated | CVE-2024-53243 |
| n/a — n/a | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin” or “power” Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report” endpoint through “s” parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will. | 2024-12-10 | not yet calculated | CVE-2024-53244 |
| n/a — n/a | In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin” or “power” Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard name and the dashboard XML by cloning the dashboard. | 2024-12-10 | not yet calculated | CVE-2024-53245 |
| n/a — n/a | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation. | 2024-12-10 | not yet calculated | CVE-2024-53246 |
| n/a — n/a | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.2.461 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin” or “power” Splunk roles could perform a Remote Code Execution (RCE). | 2024-12-10 | not yet calculated | CVE-2024-53247 |
| n/a — n/a | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch. | 2024-12-12 | not yet calculated | CVE-2024-53272 |
| n/a — n/a | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch. | 2024-12-12 | not yet calculated | CVE-2024-53273 |
| n/a — n/a | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch. | 2024-12-12 | not yet calculated | CVE-2024-53274 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53279 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53280 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in Network WOL functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53281 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53282 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53283 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53284 |
| n/a — n/a | Improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. | 2024-12-09 | not yet calculated | CVE-2024-53285 |
| n/a — n/a | Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | 2024-12-11 | not yet calculated | CVE-2024-53289 |
| n/a — n/a | Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution | 2024-12-11 | not yet calculated | CVE-2024-53290 |
| n/a — n/a | Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable component with privileges of the compromised account. | 2024-12-11 | not yet calculated | CVE-2024-53292 |
| n/a — n/a | An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. | 2024-12-09 | not yet calculated | CVE-2024-53441 |
| n/a — n/a | RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. | 2024-12-09 | not yet calculated | CVE-2024-53450 |
| n/a — n/a | Phpgurukul’s Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter. | 2024-12-10 | not yet calculated | CVE-2024-53480 |
| n/a — n/a | A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the “Firstname” and “Last name” parameters. | 2024-12-10 | not yet calculated | CVE-2024-53481 |
| n/a — n/a | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. | 2024-12-10 | not yet calculated | CVE-2024-53552 |
| n/a — n/a | File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 | 2024-12-11 | not yet calculated | CVE-2024-53677 |
| n/a — n/a | Missing Authorization vulnerability in Alexander Volkov Chatter.This issue affects Chatter: from n/a through 1.0.1. | 2024-12-09 | not yet calculated | CVE-2024-53785 |
| n/a — n/a | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through 1.2.5. | 2024-12-09 | not yet calculated | CVE-2024-53790 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS allows Stored XSS.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through 1.2.5. | 2024-12-09 | not yet calculated | CVE-2024-53791 |
| n/a — n/a | Missing Authorization vulnerability in BAKKBONE Australia FloristPress.This issue affects FloristPress: from n/a through 7.3.0. | 2024-12-09 | not yet calculated | CVE-2024-53798 |
| n/a — n/a | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Analytify.This issue affects Analytify: from n/a through 5.4.3. | 2024-12-09 | not yet calculated | CVE-2024-53814 |
| n/a — n/a | Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.5. | 2024-12-09 | not yet calculated | CVE-2024-53816 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Post Grid Team by WPXPO PostX allows Stored XSS.This issue affects PostX: from n/a through 4.1.15. | 2024-12-09 | not yet calculated | CVE-2024-53818 |
| n/a — n/a | Missing Authorization vulnerability in Sprout Invoices Client Invoicing by Sprout Invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through 20.8.0. | 2024-12-09 | not yet calculated | CVE-2024-53819 |
| n/a — n/a | Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. | 2024-12-09 | not yet calculated | CVE-2024-53822 |
| n/a — n/a | ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product’s lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware. | 2024-12-12 | not yet calculated | CVE-2024-53845 |
| n/a — n/a | The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user’s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted content. | 2024-12-09 | not yet calculated | CVE-2024-53847 |
| n/a — n/a | The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don’t revalidate the data (including on first lockfile generation). This can make workspace A (even running with `ignore-scripts=true`) posion global cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it). Here, that expectation is broken. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs. Version 9.15.0 fixes the issue. As a work-around, use separate cache and store dirs in each workspace. | 2024-12-10 | not yet calculated | CVE-2024-53866 |
| n/a — n/a | An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically proximate attackers or local admins to the webUI to trigger OS-level command execution as root. | 2024-12-10 | not yet calculated | CVE-2024-53919 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset’s SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. | 2024-12-09 | not yet calculated | CVE-2024-53947 |
| n/a — n/a | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. | 2024-12-09 | not yet calculated | CVE-2024-53948 |
| n/a — n/a | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. | 2024-12-09 | not yet calculated | CVE-2024-53949 |
| n/a — n/a | An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host. | 2024-12-10 | not yet calculated | CVE-2024-54008 |
| n/a — n/a | A vulnerability has been identified in Parasolid V36.1 (All versions < V36.1.225), Parasolid V37.0 (All versions < V37.0.173). The affected application contains an out of bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted file in X_T format. This could allow an attacker to execute code in the context of the current process. | 2024-12-10 | not yet calculated | CVE-2024-54091 |
| n/a — n/a | Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy. | 2024-12-12 | not yet calculated | CVE-2024-54096 |
| n/a — n/a | Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity. | 2024-12-12 | not yet calculated | CVE-2024-54097 |
| n/a — n/a | Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity. | 2024-12-12 | not yet calculated | CVE-2024-54098 |
| n/a — n/a | File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. | 2024-12-12 | not yet calculated | CVE-2024-54099 |
| n/a — n/a | Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. | 2024-12-12 | not yet calculated | CVE-2024-54100 |
| n/a — n/a | Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability. | 2024-12-12 | not yet calculated | CVE-2024-54101 |
| n/a — n/a | Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | not yet calculated | CVE-2024-54102 |
| n/a — n/a | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | 2024-12-12 | not yet calculated | CVE-2024-54119 |
| n/a — n/a | Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability. | 2024-12-12 | not yet calculated | CVE-2024-54122 |
| n/a — n/a | Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. | 2024-12-10 | not yet calculated | CVE-2024-54133 |
| n/a — n/a | Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue. | 2024-12-13 | not yet calculated | CVE-2024-54139 |
| n/a — n/a | Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client’s desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks (eg. public wifi, malicious DNS servers) may have all GraphQL request and response headers and bodies fully compromised including authorization tokens. The attack also allows obtaining full access to any signed-in Altair GraphQL Cloud account and replacing payment checkout pages with a malicious website. Version 8.0.5 fixes the issue. | 2024-12-09 | not yet calculated | CVE-2024-54147 |
| n/a — n/a | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and datasources read-only in Twig, in versions 1.2.7, 1.1.11, and 1.0.476. Thse who cannot upgrade may apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 to their Winter CMS installation manually to resolve the issue. In the rare event that a Winter user was relying on being able to write to models/datasources within their Twig templates, they should instead use or create components to make changes to their models. | 2024-12-09 | not yet calculated | CVE-2024-54149 |
| n/a — n/a | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to “public”, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue. | 2024-12-09 | not yet calculated | CVE-2024-54151 |
| n/a — n/a | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument. | 2024-12-10 | not yet calculated | CVE-2024-54152 |
| n/a — n/a | SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) which could have a low impact on integrity and confidentiality of data. It has no impact on availability of the application. | 2024-12-10 | not yet calculated | CVE-2024-54197 |
| n/a — n/a | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application. | 2024-12-10 | not yet calculated | CVE-2024-54198 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Envato Security Team Revy.This issue affects Revy: from n/a through 1.18. | 2024-12-09 | not yet calculated | CVE-2024-54215 |
| n/a — n/a | Missing Authorization vulnerability in Repute info systems ARForms.This issue affects ARForms: from n/a through 6.4.1. | 2024-12-09 | not yet calculated | CVE-2024-54217 |
| n/a — n/a | Missing Authorization vulnerability in Thehp AIO Contact.This issue affects AIO Contact: from n/a through 2.8.1. | 2024-12-09 | not yet calculated | CVE-2024-54218 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Thehp AIO Contact.This issue affects AIO Contact: from n/a through 2.8.1. | 2024-12-09 | not yet calculated | CVE-2024-54219 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Roninwp FAT Services Booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through 5.6. | 2024-12-09 | not yet calculated | CVE-2024-54220 |
| n/a — n/a | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Contact Form – Repute InfoSystems ARForms Form Builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through 1.7.1. | 2024-12-09 | not yet calculated | CVE-2024-54223 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.7. | 2024-12-09 | not yet calculated | CVE-2024-54224 |
| n/a — n/a | Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerability in CodegearThemes Designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through 1.3.3. | 2024-12-09 | not yet calculated | CVE-2024-54225 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Karl Kiesinger Country Blocker allows Stored XSS.This issue affects Country Blocker: from n/a through 3.2. | 2024-12-09 | not yet calculated | CVE-2024-54226 |
| n/a — n/a | Missing Authorization vulnerability in theDotstore Minimum and Maximum Quantity for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through 2.0.0. | 2024-12-09 | not yet calculated | CVE-2024-54227 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WebOccult Technologies Pvt Ltd Wot Elementor Widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through 1.0.1. | 2024-12-09 | not yet calculated | CVE-2024-54228 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPRealizer Unlock Addons for Elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through 1.0.0. | 2024-12-09 | not yet calculated | CVE-2024-54230 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in anzia Ni WooCommerce Order Export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through 3.1.6. | 2024-12-13 | not yet calculated | CVE-2024-54231 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in rrdevs RRAddons for Elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through 1.1.0. | 2024-12-09 | not yet calculated | CVE-2024-54232 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Enea Overclokk Advanced Control Manager for WordPress by ItalyStrap allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through 2.16.0. | 2024-12-13 | not yet calculated | CVE-2024-54233 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in wp-buy Limit Login Attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through 5.5. | 2024-12-13 | not yet calculated | CVE-2024-54234 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Shiptimize Shiptimize for WooCommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through 3.1.86. | 2024-12-13 | not yet calculated | CVE-2024-54235 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in anzia Ni WooCommerce Bulk Product Editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through 1.4.5. | 2024-12-13 | not yet calculated | CVE-2024-54236 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in anzia Ni CRM Lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through 1.3.0. | 2024-12-13 | not yet calculated | CVE-2024-54237 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Colin Tomele Board Document Manager from CHUHPL allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through 1.9.1. | 2024-12-13 | not yet calculated | CVE-2024-54238 |
| n/a — n/a | Missing Authorization vulnerability in dugudlabs Eyewear prescription form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through 4.0.18. | 2024-12-13 | not yet calculated | CVE-2024-54239 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Blaze Online Blaze Online eParcel for WooCommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through 1.3.3. | 2024-12-13 | not yet calculated | CVE-2024-54240 |
| n/a — n/a | Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a. | 2024-12-13 | not yet calculated | CVE-2024-54241 |
| n/a — n/a | Missing Authorization vulnerability in Appsbd Simple Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through 1.3. | 2024-12-13 | not yet calculated | CVE-2024-54242 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Think201 Echoza allows Stored XSS.This issue affects Echoza: from n/a through 0.1.1. | 2024-12-13 | not yet calculated | CVE-2024-54243 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Think201 Easy Replace allows Stored XSS.This issue affects Easy Replace: from n/a through 1.3. | 2024-12-13 | not yet calculated | CVE-2024-54244 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Think201 Clients allows Stored XSS.This issue affects Clients: from n/a through 1.1.4. | 2024-12-13 | not yet calculated | CVE-2024-54245 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Think201 FAQs allows Stored XSS.This issue affects FAQs: from n/a through 1.0.2. | 2024-12-13 | not yet calculated | CVE-2024-54246 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2. | 2024-12-09 | not yet calculated | CVE-2024-54247 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Michael DUMONTET eewee admin custom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through 1.8.2.4. | 2024-12-13 | not yet calculated | CVE-2024-54248 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Prodigy Commerce Prodigy Commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through 3.0.8. | 2024-12-13 | not yet calculated | CVE-2024-54250 |
| n/a — n/a | Missing Authorization vulnerability in Prodigy Commerce Prodigy Commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through 3.0.9. | 2024-12-09 | not yet calculated | CVE-2024-54251 |
| n/a — n/a | Missing Authorization vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.5.2. | 2024-12-13 | not yet calculated | CVE-2024-54252 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.6.1. | 2024-12-09 | not yet calculated | CVE-2024-54253 |
| n/a — n/a | Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7.This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3. | 2024-12-09 | not yet calculated | CVE-2024-54254 |
| n/a — n/a | URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in aviplugins.com Login Widget With Shortcode allows Phishing.This issue affects Login Widget With Shortcode: from n/a through 6.1.2. | 2024-12-09 | not yet calculated | CVE-2024-54255 |
| n/a — n/a | Missing Authorization vulnerability in Seerox Easy Blocks pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through 1.0.21. | 2024-12-13 | not yet calculated | CVE-2024-54256 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in anzia Ni CRM Lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through 1.3.0. | 2024-12-13 | not yet calculated | CVE-2024-54258 |
| n/a — n/a | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in DELUCKS GmbH DELUCKS SEO allows Path Traversal.This issue affects DELUCKS SEO: from n/a through 2.5.5. | 2024-12-13 | not yet calculated | CVE-2024-54259 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in BlazeThemes News Kit Elementor Addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through 1.2.2. | 2024-12-09 | not yet calculated | CVE-2024-54260 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through 1.1.2. | 2024-12-13 | not yet calculated | CVE-2024-54261 |
| n/a — n/a | Unrestricted Upload of File with Dangerous Type vulnerability in Siddharth Nagar Import Export For WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through 1.5. | 2024-12-13 | not yet calculated | CVE-2024-54262 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in César Morillas Shortcodes Blocks Creator Ultimate allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through 2.2.0. | 2024-12-13 | not yet calculated | CVE-2024-54264 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.6.6. | 2024-12-13 | not yet calculated | CVE-2024-54265 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ImageRecycle ImageRecycle pdf & image compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through 3.1.16. | 2024-12-13 | not yet calculated | CVE-2024-54266 |
| n/a — n/a | Missing Authorization vulnerability in CreativeMindsSolutions CM Answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through 3.2.6. | 2024-12-13 | not yet calculated | CVE-2024-54267 |
| n/a — n/a | Missing Authorization vulnerability in SiteOrigin SiteOrigin Widgets Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through 1.64.0. | 2024-12-13 | not yet calculated | CVE-2024-54268 |
| n/a — n/a | Missing Authorization vulnerability in Ninja Team Notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notibar: from n/a through 2.1.4. | 2024-12-11 | not yet calculated | CVE-2024-54269 |
| n/a — n/a | Missing Authorization vulnerability in WPTaskForce WPCargo Track & Trace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through 7.0.6. | 2024-12-13 | not yet calculated | CVE-2024-54271 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in RadiusTheme Radius Blocks – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Radius Blocks – WordPress Gutenberg Blocks: from n/a through 2.1.2. | 2024-12-13 | not yet calculated | CVE-2024-54272 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker allows Object Injection.This issue affects Mail Picker: from n/a through 1.0.14. | 2024-12-13 | not yet calculated | CVE-2024-54273 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Octrace Studio WordPress HelpDesk & Support Ticket System Plugin – Octrace Support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through 1.2.7. | 2024-12-13 | not yet calculated | CVE-2024-54274 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Wibergs Web CSV to html allows Reflected XSS.This issue affects CSV to html: from n/a through 3.04. | 2024-12-13 | not yet calculated | CVE-2024-54275 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Felix Moira Poll Builder allows Stored XSS.This issue affects Poll Builder: from n/a through 1.3.5. | 2024-12-13 | not yet calculated | CVE-2024-54276 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Alireza aliniya Nias course allows DOM-Based XSS.This issue affects Nias course: from n/a through 1.2.1. | 2024-12-13 | not yet calculated | CVE-2024-54277 |
| n/a — n/a | Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through 2.1.3. | 2024-12-13 | not yet calculated | CVE-2024-54278 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu allows Object Injection.This issue affects WP Mega Menu: from n/a through 1.4.2. | 2024-12-13 | not yet calculated | CVE-2024-54282 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Sendsmaily LLC Smaily for WP allows Stored XSS.This issue affects Smaily for WP: from n/a through 3.1.2. | 2024-12-13 | not yet calculated | CVE-2024-54286 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Best Wp Developer Advanced Blog Post Block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through 1.0.4. | 2024-12-13 | not yet calculated | CVE-2024-54287 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in LDD Web Design LDD Directory Lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through 3.3. | 2024-12-13 | not yet calculated | CVE-2024-54288 |
| n/a — n/a | Missing Authorization vulnerability in Awesome Support Team Awesome Support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through 6.3.0. | 2024-12-13 | not yet calculated | CVE-2024-54289 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Justin Fletcher Role Includer allows Reflected XSS.This issue affects Role Includer: from n/a through 1.6. | 2024-12-13 | not yet calculated | CVE-2024-54290 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Appsplate Appsplate allows SQL Injection.This issue affects Appsplate: from n/a through 2.1.3. | 2024-12-13 | not yet calculated | CVE-2024-54292 |
| n/a — n/a | Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through 2.2.0. | 2024-12-13 | not yet calculated | CVE-2024-54293 |
| n/a — n/a | Authentication Bypass Using an Alternate Path or Channel vulnerability in appgenixinfotech Firebase OTP Authentication allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through 1.0.1. | 2024-12-13 | not yet calculated | CVE-2024-54294 |
| n/a — n/a | Authentication Bypass Using an Alternate Path or Channel vulnerability in InspireUI ListApp Mobile Manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through 1.7.7. | 2024-12-13 | not yet calculated | CVE-2024-54295 |
| n/a — n/a | Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through 1.2. | 2024-12-13 | not yet calculated | CVE-2024-54296 |
| n/a — n/a | Authentication Bypass Using an Alternate Path or Channel vulnerability in www.vbsso.com vBSSO-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through 1.4.3. | 2024-12-13 | not yet calculated | CVE-2024-54297 |
| n/a — n/a | Missing Authorization vulnerability in Bill Minozzi Car Dealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through 4.46. | 2024-12-13 | not yet calculated | CVE-2024-54298 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Revi Revi.io allows Reflected XSS.This issue affects Revi.io: from n/a through 5.7.3. | 2024-12-13 | not yet calculated | CVE-2024-54299 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Neuralabz LTD. AutoWP allows Cross Site Request Forgery.This issue affects AutoWP: from n/a through 2.0.8. | 2024-12-13 | not yet calculated | CVE-2024-54300 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in FormFacade FormFacade allows Reflected XSS.This issue affects FormFacade: from n/a through 1.3.6. | 2024-12-13 | not yet calculated | CVE-2024-54301 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Vikas Ratudi VForm allows Reflected XSS.This issue affects VForm: from n/a through 3.0.0. | 2024-12-13 | not yet calculated | CVE-2024-54302 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ido Kobelkowsky / yalla ya! Simple Payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.3.7. | 2024-12-13 | not yet calculated | CVE-2024-54303 |
| n/a — n/a | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Hive Support Hive Support – WordPress Help Desk allows SQL Injection.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.2. | 2024-12-13 | not yet calculated | CVE-2024-54304 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in woocs J&T Express Malaysia allows Reflected XSS.This issue affects J&T Express Malaysia: from n/a through 2.0.13. | 2024-12-13 | not yet calculated | CVE-2024-54305 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in KCT AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot allows Cross Site Request Forgery.This issue affects AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: from n/a through 1.6.2. | 2024-12-13 | not yet calculated | CVE-2024-54306 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in AIpost AIcomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through 1.4.1. | 2024-12-13 | not yet calculated | CVE-2024-54307 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in CurrencyRate.today Cryptocurrency Price Widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through 1.2.3. | 2024-12-13 | not yet calculated | CVE-2024-54308 |
| n/a — n/a | Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through 1.0.4. | 2024-12-13 | not yet calculated | CVE-2024-54309 |
| n/a — n/a | Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through 1.0.1.8. | 2024-12-13 | not yet calculated | CVE-2024-54310 |
| n/a — n/a | Missing Authorization vulnerability in i.lychkov Mark New Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through 7.5.1. | 2024-12-13 | not yet calculated | CVE-2024-54311 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ??????? ????? Persian Woocommerce SMS allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through 7.0.5. | 2024-12-13 | not yet calculated | CVE-2024-54312 |
| n/a — n/a | Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25. | 2024-12-13 | not yet calculated | CVE-2024-54313 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in NicheAddons Primary Addon for Elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through 1.6.0. | 2024-12-13 | not yet calculated | CVE-2024-54314 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in NicheAddons Events Addon for Elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through 2.2.2. | 2024-12-13 | not yet calculated | CVE-2024-54315 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.8. | 2024-12-13 | not yet calculated | CVE-2024-54316 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Google Web Stories allows Stored XSS.This issue affects Web Stories: from n/a through 1.37.0. | 2024-12-13 | not yet calculated | CVE-2024-54317 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in nicejob NiceJob allows Stored XSS.This issue affects NiceJob: from n/a through 3.6.5. | 2024-12-13 | not yet calculated | CVE-2024-54318 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MultiNet Interactive AB Kundgenerator allows Reflected XSS.This issue affects Kundgenerator: from n/a through 1.0.6. | 2024-12-13 | not yet calculated | CVE-2024-54319 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ICDSoft Hosting ICDSoft Reseller Store allows Reflected XSS.This issue affects ICDSoft Reseller Store: from n/a through 2.4.5. | 2024-12-13 | not yet calculated | CVE-2024-54320 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Hive Support Hive Support – WordPress Help Desk allows Cross Site Request Forgery.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.2. | 2024-12-13 | not yet calculated | CVE-2024-54321 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ederson Peka Media Downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through 0.4.7.4. | 2024-12-13 | not yet calculated | CVE-2024-54322 |
| n/a — n/a | Missing Authorization vulnerability in WPExpertsio New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through 2.6.2. | 2024-12-13 | not yet calculated | CVE-2024-54323 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Cloud Inn SMSify allows Reflected XSS.This issue affects SMSify: from n/a through 6.0.4. | 2024-12-13 | not yet calculated | CVE-2024-54324 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in DealerTrend CarDealerPress allows Reflected XSS.This issue affects CarDealerPress: from n/a through 6.6.2410.02. | 2024-12-13 | not yet calculated | CVE-2024-54325 |
| n/a — n/a | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.0.4. | 2024-12-13 | not yet calculated | CVE-2024-54326 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in universam UNIVERSAM allows Reflected XSS.This issue affects UNIVERSAM: from n/a through n/a. | 2024-12-13 | not yet calculated | CVE-2024-54327 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Link Nacional Invoice Payment for WooCommerce allows Reflected XSS.This issue affects Invoice Payment for WooCommerce: from n/a through 1.7.2. | 2024-12-13 | not yet calculated | CVE-2024-54328 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Metup s.r.l. CleverNode Related Content allows Reflected XSS.This issue affects CleverNode Related Content: from n/a through 1.1.5. | 2024-12-13 | not yet calculated | CVE-2024-54329 |
| n/a — n/a | Server-Side Request Forgery (SSRF) vulnerability in Hep Hep Hurra (HHH) Hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through 2.4. | 2024-12-13 | not yet calculated | CVE-2024-54330 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in silverplugins217 Check Pincode For Woocommerce allows Reflected XSS.This issue affects Check Pincode For Woocommerce: from n/a through 1.1. | 2024-12-13 | not yet calculated | CVE-2024-54333 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Zeshan B Quran Phrases About Most People Shortcodes allows DOM-Based XSS.This issue affects Quran Phrases About Most People Shortcodes: from n/a through 1.4. | 2024-12-13 | not yet calculated | CVE-2024-54334 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ZebraSoft Monaco ImmoToolBox Connect allows Reflected XSS.This issue affects ImmoToolBox Connect: from n/a through 1.3.3. | 2024-12-13 | not yet calculated | CVE-2024-54335 |
| n/a — n/a | Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia allows Authentication Bypass.This issue affects Projectopia: from n/a through 5.1.7. | 2024-12-13 | not yet calculated | CVE-2024-54336 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site allows Stored XSS.This issue affects DX Dark Site: from n/a through 1.0.1. | 2024-12-13 | not yet calculated | CVE-2024-54337 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Christer Fernstrom Hello Event Widgets For Elementor allows DOM-Based XSS.This issue affects Hello Event Widgets For Elementor: from n/a through 1.0.2. | 2024-12-13 | not yet calculated | CVE-2024-54338 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in jbd7 geoFlickr allows Reflected XSS.This issue affects geoFlickr: from n/a through 1.3. | 2024-12-13 | not yet calculated | CVE-2024-54339 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Sylvia van Os Simple Presenter allows Reflected XSS.This issue affects Simple Presenter: from n/a through 1.5.1. | 2024-12-13 | not yet calculated | CVE-2024-54340 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in LabelGrid LabelGrid Tools allows Reflected XSS.This issue affects LabelGrid Tools: from n/a through 1.3.58. | 2024-12-13 | not yet calculated | CVE-2024-54341 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in STAGGS Staggs Product Configurator for WooCommerce allows Reflected XSS.This issue affects Staggs Product Configurator for WooCommerce: from n/a through 2.0.0. | 2024-12-13 | not yet calculated | CVE-2024-54342 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Howard Ehrenberg Connect Contact Form 7 to Constant Contact allows Reflected XSS.This issue affects Connect Contact Form 7 to Constant Contact: from n/a through 1.4. | 2024-12-13 | not yet calculated | CVE-2024-54343 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Fahad Mahmood WP Quick Shop allows Reflected XSS.This issue affects WP Quick Shop: from n/a through 1.3.1. | 2024-12-13 | not yet calculated | CVE-2024-54344 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in SKT Themes Bicycleshop allows DOM-Based XSS.This issue affects Bicycleshop: from n/a through 1.5. | 2024-12-13 | not yet calculated | CVE-2024-54345 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in SKT Themes Barter allows DOM-Based XSS.This issue affects Barter: from n/a through 1.6. | 2024-12-13 | not yet calculated | CVE-2024-54346 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in BAKKBONE Australia FloristPress allows Reflected XSS.This issue affects FloristPress: from n/a through 7.2.0. | 2024-12-13 | not yet calculated | CVE-2024-54347 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in mashiurz.com Plain Post allows Stored XSS.This issue affects Plain Post: from n/a through 1.0.3. | 2024-12-13 | not yet calculated | CVE-2024-54349 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) vulnerability in Tom Landis Fancy Roller Scroller allows Stored XSS.This issue affects Fancy Roller Scroller: from n/a through 1.4.0. | 2024-12-13 | not yet calculated | CVE-2024-54351 |
| n/a — n/a | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An encrypted volume may be accessed by a different user without prompting for the password. | 2024-12-12 | not yet calculated | CVE-2024-54466 |
| n/a — n/a | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to leak a user’s credentials. | 2024-12-12 | not yet calculated | CVE-2024-54471 |
| n/a — n/a | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to access user-sensitive data. | 2024-12-12 | not yet calculated | CVE-2024-54476 |
| n/a — n/a | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user’s Keychain items. | 2024-12-12 | not yet calculated | CVE-2024-54490 |
| n/a — n/a | The issue was resolved by sanitizing logging This issue is fixed in macOS Sequoia 15.2. A malicious application may be able to determine a user’s current location. | 2024-12-12 | not yet calculated | CVE-2024-54491 |
| n/a — n/a | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, visionOS 2.2. An attacker in a privileged network position may be able to alter network traffic. | 2024-12-12 | not yet calculated | CVE-2024-54492 |
| n/a — n/a | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected parts of the file system. | 2024-12-12 | not yet calculated | CVE-2024-54495 |
| n/a — n/a | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Processing a maliciously crafted file may lead to a denial of service. | 2024-12-12 | not yet calculated | CVE-2024-54501 |
| n/a — n/a | The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. | 2024-12-12 | not yet calculated | CVE-2024-54502 |
| n/a — n/a | The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox. | 2024-12-12 | not yet calculated | CVE-2024-54514 |
| n/a — n/a | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to access arbitrary files. | 2024-12-12 | not yet calculated | CVE-2024-54524 |
| n/a — n/a | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to execute arbitrary code with kernel privileges. | 2024-12-12 | not yet calculated | CVE-2024-54529 |
| n/a — n/a | COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. | 2024-12-10 | not yet calculated | CVE-2024-54751 |
| n/a — n/a | A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote attackers to execute arbitrary code via the mobileno parameter. | 2024-12-12 | not yet calculated | CVE-2024-54810 |
| n/a — n/a | A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the “login” parameter. | 2024-12-12 | not yet calculated | CVE-2024-54811 |
| n/a — n/a | A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno parameter. | 2024-12-12 | not yet calculated | CVE-2024-54842 |
| n/a — n/a | Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. | 2024-12-09 | not yet calculated | CVE-2024-54918 |
| n/a — n/a | A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, firstname, lastname, and class_id parameters. | 2024-12-09 | not yet calculated | CVE-2024-54921 |
| n/a — n/a | A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter. | 2024-12-09 | not yet calculated | CVE-2024-54923 |
| n/a — n/a | A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters. | 2024-12-09 | not yet calculated | CVE-2024-54924 |
| n/a — n/a | A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter. | 2024-12-09 | not yet calculated | CVE-2024-54925 |
| n/a — n/a | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php. | 2024-12-09 | not yet calculated | CVE-2024-54927 |
| n/a — n/a | kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php, | 2024-12-09 | not yet calculated | CVE-2024-54928 |
| n/a — n/a | A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter. | 2024-12-09 | not yet calculated | CVE-2024-54931 |
| n/a — n/a | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php. | 2024-12-09 | not yet calculated | CVE-2024-54932 |
| n/a — n/a | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php. | 2024-12-09 | not yet calculated | CVE-2024-54934 |
| n/a — n/a | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads. | 2024-12-09 | not yet calculated | CVE-2024-54938 |
| n/a — n/a | A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username parameter. | 2024-12-12 | not yet calculated | CVE-2024-55099 |
| n/a — n/a | Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim’s machine. | 2024-12-10 | not yet calculated | CVE-2024-55500 |
| n/a — n/a | Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. | 2024-12-10 | not yet calculated | CVE-2024-55544 |
| n/a — n/a | Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. | 2024-12-10 | not yet calculated | CVE-2024-55545 |
| n/a — n/a | Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. | 2024-12-10 | not yet calculated | CVE-2024-55546 |
| n/a — n/a | SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e. | 2024-12-10 | not yet calculated | CVE-2024-55547 |
| n/a — n/a | Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-420: through 2.01e. | 2024-12-10 | not yet calculated | CVE-2024-55548 |
| n/a — n/a | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation. | 2024-12-10 | not yet calculated | CVE-2024-55550 |
| n/a — n/a | Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example, the outcome of an HTLC (Hashed Timelock Contract) can be changed because a flood of transaction traffic prevents propagation of certain Lightning channel transactions. | 2024-12-09 | not yet calculated | CVE-2024-55563 |
| n/a — n/a | The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow. | 2024-12-09 | not yet calculated | CVE-2024-55564 |
| n/a — n/a | nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. | 2024-12-09 | not yet calculated | CVE-2024-55565 |
| n/a — n/a | ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting files or making ColPack graphing unavailable to other users. | 2024-12-09 | not yet calculated | CVE-2024-55566 |
| n/a — n/a | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. | 2024-12-09 | not yet calculated | CVE-2024-55578 |
| n/a — n/a | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. | 2024-12-09 | not yet calculated | CVE-2024-55579 |
| n/a — n/a | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote commands that could cause high availability damages, including high integrity and confidentiality risks. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. | 2024-12-09 | not yet calculated | CVE-2024-55580 |
| n/a — n/a | Oxide before 6 has unencrypted Control Plane datastores. | 2024-12-09 | not yet calculated | CVE-2024-55582 |
| n/a — n/a | Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor’s position is that this is intended behavior. | 2024-12-10 | not yet calculated | CVE-2024-55586 |
| n/a — n/a | python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract. | 2024-12-12 | not yet calculated | CVE-2024-55587 |
| n/a — n/a | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates. | 2024-12-09 | not yet calculated | CVE-2024-55601 |
| n/a — n/a | PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue. | 2024-12-10 | not yet calculated | CVE-2024-55602 |
| n/a — n/a | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. | 2024-12-12 | not yet calculated | CVE-2024-55633 |
| n/a — n/a | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 2024-12-10 | not yet calculated | CVE-2024-55634 |
| n/a — n/a | Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102. | 2024-12-10 | not yet calculated | CVE-2024-55635 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 2024-12-10 | not yet calculated | CVE-2024-55636 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 2024-12-10 | not yet calculated | CVE-2024-55637 |
| n/a — n/a | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. | 2024-12-10 | not yet calculated | CVE-2024-55638 |
| n/a — n/a | PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue. | 2024-12-12 | not yet calculated | CVE-2024-55652 |
| n/a — n/a | PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The user doesn’t need to know the audit id, since a bad audit id will also raise the rejection. With the backend being unresponsive, the whole application becomes unusable for all users of the application. As of time of publication, no known patches are available. | 2024-12-10 | not yet calculated | CVE-2024-55653 |
| n/a — n/a | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the “integration time” present in “v2” and “v3” bundles during the verification flow: the “integration time” is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect “v1” bundles, as the “v1” bundle format always requires an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry’s time. However, this would still be rejected at validation time, as the new entry’s (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable. | 2024-12-10 | not yet calculated | CVE-2024-55655 |
| n/a — n/a | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan’s `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue. | 2024-12-12 | not yet calculated | CVE-2024-55657 |
| n/a — n/a | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan’s /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue. | 2024-12-12 | not yet calculated | CVE-2024-55658 |
| n/a — n/a | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. | 2024-12-12 | not yet calculated | CVE-2024-55659 |
| n/a — n/a | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan’s `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue. | 2024-12-12 | not yet calculated | CVE-2024-55660 |
| n/a — n/a | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = ”)` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch. | 2024-12-13 | not yet calculated | CVE-2024-55661 |
| n/a — n/a | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`. | 2024-12-12 | not yet calculated | CVE-2024-55662 |
| n/a — n/a | XWiki Platform is a generic wiki platform. Starting in version 11.10.6 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This has been patched in 13.10.5 and 14.3-rc-1. There is no known workaround, other than upgrading XWiki. | 2024-12-12 | not yet calculated | CVE-2024-55663 |
| n/a — n/a | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 5.41.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. Version 5.41.0.0 contains a patch for the issue. | 2024-12-12 | not yet calculated | CVE-2024-55875 |
| n/a — n/a | XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a subwiki. Then, click on any operation (*e.g.,* Trigger) on any job. If the operation is successful, then the instance is vulnerable. This has been patched in XWiki 15.10.9 and 16.3.0. As a workaround, those who have subwikis where the Job Scheduler is enabled can edit the objects on `Scheduler.WebPreferences` to match the patch. | 2024-12-12 | not yet calculated | CVE-2024-55876 |
| n/a — n/a | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround. | 2024-12-12 | not yet calculated | CVE-2024-55877 |
| n/a — n/a | SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don’t use direct publication via toHTMLEx. | 2024-12-12 | not yet calculated | CVE-2024-55878 |
| n/a — n/a | XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading. | 2024-12-12 | not yet calculated | CVE-2024-55879 |
| n/a — n/a | In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial. | 2024-12-12 | not yet calculated | CVE-2024-55884 |
| n/a — n/a | beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256. | 2024-12-12 | not yet calculated | CVE-2024-55885 |
| n/a — n/a | OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication plugins will not perform authentication. This allows unauthorized users to ingest OpenTelemetry Logs data under certain conditions. This vulnerability does not affect the built-in `http_basic` authentication provider in Data Prepper. Pipelines which use the `http_basic` authentication provider continue to require authentication. The vulnerability exists only for custom implementations of Data Prepper’s `GrpcAuthenticationProvider` authentication plugin which implement the `getHttpAuthenticationService()` method instead of `getAuthenticationInterceptor()`. Data Prepper 2.10.2 contains a fix for this issue. For those unable to upgrade, one may use the built-in `http_basic` authentication provider in Data Prepper and/or add an authentication proxy in front of one’s Data Prepper instances running the OpenTelemetry Logs source. | 2024-12-12 | not yet calculated | CVE-2024-55886 |
| n/a — n/a | Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted. | 2024-12-13 | not yet calculated | CVE-2024-55887 |
| n/a — n/a | Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.5 fixed the issue. | 2024-12-12 | not yet calculated | CVE-2024-55888 |
| n/a — n/a | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim’s machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue. | 2024-12-13 | not yet calculated | CVE-2024-55889 |
| n/a — n/a | D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users. | 2024-12-13 | not yet calculated | CVE-2024-55890 |
| n/a — n/a | An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML injection by an attacker who can create a file in the current working directory. | 2024-12-13 | not yet calculated | CVE-2024-55918 |
| n/a — n/a | Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have entered into the software. This poses a risk to user privacy. The maintainers of Playloom Engine have temporarily disabled the collaboration feature until a fix can be implemented. When Engine Beta v0.0.2 is released, it is expected to contain a patch addressing this issue. Users should refrain from using the collaboration feature in the meantime. | 2024-12-13 | not yet calculated | CVE-2024-55946 |
| n/a — n/a | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. | 2024-12-13 | not yet calculated | CVE-2024-55956 |
| n/a — n/a | DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714. | 2024-12-15 | not yet calculated | CVE-2024-55969 |
| n/a — n/a | File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734. | 2024-12-15 | not yet calculated | CVE-2024-55970 |
| n/a — n/a | An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (application crash) via a crafted packet that specifies many sFlow samples. | 2024-12-15 | not yet calculated | CVE-2024-56072 |
| n/a — n/a | An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote attackers to cause a denial of service (divide-by-zero error and application crash). | 2024-12-15 | not yet calculated | CVE-2024-56073 |
| n/a — n/a | gitingest before 9996a06 mishandles symbolic links that point outside of the base directory. | 2024-12-15 | not yet calculated | CVE-2024-56074 |
| n/a — n/a | ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true. | 2024-12-15 | not yet calculated | CVE-2024-56082 |
| n/a — n/a | Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on A77, A78, A78C, A78AE, A710, V1, V2, V3, V3AE, X1, X1C, X2, X3, X4, N2, X925 & Travis may permit bypass of Stage-2 translation and/or GPT protection | 2024-12-10 | not yet calculated | CVE-2024-5660 |
| n/a — n/a | Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. | 2024-12-10 | not yet calculated | CVE-2024-7572 |
| n/a — n/a | Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0. | 2024-12-15 | not yet calculated | CVE-2024-7701 |
| n/a — n/a | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled. | 2024-12-12 | not yet calculated | CVE-2024-8179 |
| n/a — n/a | An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request. | 2024-12-12 | not yet calculated | CVE-2024-8233 |
| n/a — n/a | In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API. | 2024-12-10 | not yet calculated | CVE-2024-8256 |
| n/a — n/a | Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components. | 2024-12-10 | not yet calculated | CVE-2024-8540 |
| n/a — n/a | An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled. | 2024-12-12 | not yet calculated | CVE-2024-8647 |
| n/a — n/a | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs. | 2024-12-12 | not yet calculated | CVE-2024-9367 |
| n/a — n/a | An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint. | 2024-12-12 | not yet calculated | CVE-2024-9387 |
| n/a — n/a | The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-9428 |
| n/a — n/a | Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code. | 2024-12-13 | not yet calculated | CVE-2024-9508 |
| n/a — n/a | The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-9641 |
| n/a — n/a | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-09 | not yet calculated | CVE-2024-9651 |
| n/a — n/a | A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur. | 2024-12-10 | not yet calculated | CVE-2024-9672 |
| n/a — n/a | Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions. | 2024-12-10 | not yet calculated | CVE-2024-9844 |
| n/a — n/a | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 2024-12-12 | not yet calculated | CVE-2024-9881 |
| n/a — n/a | An information-disclosure vulnerability exists in Fortra’s GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders. | 2024-12-13 | not yet calculated | CVE-2024-9945 |
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
