Vulnerability Notes
- CVE-2024-49576 | Foxit Reader 2024.3.0.26795 Checkbox CBF_Widget Object use after free (TALOS-2024-2093)
- CVE-2024-47810 | Foxit Reader 2024.3.0.26795 3D Page Object use after free (TALOS-2024-2094)
- CVE-2024-52361 | IBM Storage Defender up to 2.0.9 Resiliency Service credentials storage
- CVE-2024-47119 | IBM Storage Defender up to 2.0.9 Resiliency Service certificate validation
- CVE-2023-50956 | IBM Storage Defender up to 2.0.9 Resiliency Service credentials storage
- CVE-2024-45082 | IBM Cognos Analytics up to 11.2.4/12.0.3 redirect
- CVE-2024-41752 | IBM Cognos Analytics up to 11.2.4/12.0.3 cross site scripting
- CVE-2024-56128 | Apache Kafka up to 3.7.1/3.8.0 SCRAM incorrect implementation of authentication algorithm
- CVE-2024-12121 | Broken Link Checker Plugin up to 2.5.0 on WordPress server-side request forgery
- CVE-2024-50570 | Fortinet FortiClientMac/FortiClientLinux/FortiClientWindows cleartext storage (FG-IR-23-278)
- CVE-2024-48889 | Fortinet FortiManager up to 6.4.14/7.0.12/7.2.7/7.4.4/7.6.0 FGFM Request os command injection (FG-IR-24-425)
- CVE-2023-34990 | Fortinet FortiWLM up to 8.5.4/8.6.5 Web Request path traversal (FG-IR-23-144)
- CVE-2024-54350 | HJYL hmd Plugin up to 2.0 on WordPress cross site scripting
- CVE-2024-56058 | Gueststream VRPConnector Plugin up to 2.0.1 on WordPress deserialization
- CVE-2024-56016 | WPTooling Image Mapper Plugin up to 0.2.5.3 on WordPress cross site scripting
- CVE-2024-56010 | PerfOps One Device Detector Plugin up to 4.2.0 on WordPress cross site scripting
- CVE-2024-4996 | Asseco Business Solutions Wapro ERP Desktop prior 8.90.0 hard-coded credentials
- CVE-2024-51646 | Saoshyant Element Plugin up to 1.2 on WordPress cross site scripting
- CVE-2024-56059 | Mighty Digital Partners Plugin up to 0.2.0 on WordPress prototype pollution
- CVE-2024-49677 | David Cramer Bootstrap Buttons Plugin up to 1.2 on WordPress cross site scripting
- CVE-2024-55997 | Web Chunky Order Delivery & Pickup Location Date Time Plugin up to 1.1.0 on WordPress authorization
- CVE-2024-55985 | ydesignservices YDS Support Ticket System Plugin up to 1.0 on WordPress sql injection
- CVE-2024-55984 | susheelhbti Saksh Escrow System Plugin up to 2.4 on WordPress sql injection
- CVE-2024-55983 | Derek Hamilton PowerFormBuilder Plugin up to 1.0.6 on WordPress sql injection
- CVE-2024-55975 | Rohit Urane Dr Affiliate Plugin up to 1.2.3 on WordPress sql injection
- CVE-2024-52485 | Yudiz Solutions WP Menu Image Plugin up to 2.2 on WordPress authorization
- CVE-2024-56008 | Spreadr Woocommerce Plugin up to 1.0.4 on WordPress authorization
- CVE-2024-11291 | madalinungureanu Paid Membership Subscriptions Plugin up to 2.13.4 on WordPress information disclosure
- CVE-2024-54270 | Axeptio Plugin up to 2.5.3 on WordPress filename control
- CVE-2024-47104 | IBM i 7.4/7.5 Physical File Security Attributes permission assignment
- CVE-2024-12454 | Affiliate Program Suite Plugin up to 1.1.23 on WordPress cross-site request forgery
- CVE-2024-12554 | Peter Custom Anti-Spam Plugin up to 3.2.3 on WordPress cas_register_post cross-site request forgery
- CVE-2024-11912 | Traveler Plugin up to 3.1.6 on WordPress order_id sql injection
- CVE-2024-11926 | Traveler Plugin up to 3.1.6 on WordPress Ajax Action authorization
- CVE-2024-12340 | Animation Addons for Elementor Plugin up to 1.1.6 on WordPress Content Slider/Tabs Widget Elementor Template information disclosure
- CVE-2024-53688 | FXC AE1021/AE1021PE up to 2.0.10 HTTP Request os command injection
- CVE-2024-54457 | FXC AE1021/AE1021PE up to 2.0.10 inclusion of undocumented features or chicken bits
- CVE-2024-47397 | FXC AE1021/AE1021PE up to 2.0.10 weak authentication
- CVE-2024-1610 | OPPO Store App 4.32.1 improper authentication
- CVE-2024-31668 | rizin up to 0.6.2 librz/analysis/meta meta_set neutralization
- CVE-2024-29646 | radare2 5.8.8 name/type/group buffer overflow
- CVE-2023-37940 | Liferay Portal/DXP up to 7.4.3.87 Access Policy Page Service Class cross site scripting
- CVE-2024-51175 | H3C Switch H3C-S1526 S1526.cfg information disclosure
- CVE-2024-11993 | Liferay Portal/DXP Dispatch name cross site scripting
- CVE-2024-55056 | PHPGurukul Online Birth Certificate System 1.0 certificate-form.php full name cross site scripting
- CVE-2024-10892 | Cost Calculator Builder Plugin up to 3.2.42 on WordPress cross-site request forgery
- CVE-2024-21548 | bun up to 1.1.29 API prototype pollution (SNYK-JS-BUN-8499549)
- CVE-2024-21547 | spatie browsershot up to 5.0.1 Normalization path traversal (SNYK-PHP-SPATIEBROWSERSHOT-8501858)
- CVE-2024-4464 | Synology Media Server prior 1.4-2680/2.0.5-3152/2.2.0-3325 Streaming Service authorization (SA_24_28)
- CVE-2024-21546 | UniSharp laravel-filemanager up to 2.9.0 code injection
- CVE-2024-47480 | Dell Inventory Collector Client up to 12.6.x symlink (dsa-2024-475)
- CVE-2024-56175 | Optimizely Configured Commerce up to 5.2.2407 List Item Name cross site scripting
- CVE-2024-56174 | Optimizely Configured Commerce up to 5.2.2407 Search History cross site scripting
- CVE-2024-56173 | Optimizely Configured Commerce up to 5.2.2407 SVG Document cross site scripting
- CVE-2024-10973 | Red Hat Keycloak JGroups Replication Configuration cleartext transmission
- CVE-2024-56170 | NICMx Fort up to 1.6.4 Manifest manifestNumber/thisUpdate comparison
- CVE-2024-12539 | Elastic Elasticsearch up to 8.16.1 Query authorization
- CVE-2024-12698 | Red Hat OpenShift Container Platform 4 ose-olm-catalogd-container resource consumption
- CVE-2024-56169 | NICMx Fort up to 1.6.4 RPKI Data (ID 82)
- CVE-2024-55059 | PHPGurukul Online Birth Certificate System 1.0 certificate-form.php cross site scripting
- CVE-2024-55057 | PHPGurukul Online Birth Certificate System 1.0 weak password
- CVE-2024-49194 | Databricks JDBC Driver up to 2.6.39 JNDI krbJAASFile injection
- CVE-2024-56142 | Aiven-Open pghoard prior 2.2.2a path traversal (GHSA-m9hc-vxjj-4x6q)
- CVE-2024-55516 | Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 3.90 Web Interface /upload_sysconfig.php form name unrestricted upload
- CVE-2024-55515 | Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 3.90 Web Interface /upload_ipslib.php form name unrestricted upload
- CVE-2024-55514 | Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 3.90 Web Interface /upload_sfmig.php form name unrestricted upload
- CVE-2024-55513 | Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 3.90 Web Interface /upload_netaction.php form name unrestricted upload
- CVE-2024-52792 | LDAPAccountManager LAM up to 8.x Setting mainmanage.php external reference (GHSA-fm9w-7m7v-wxqv)
- CVE-2024-55058 | PHPGurukul Online Birth Certificate System 1.0 view-application-detail.php viewid resource injection
- CVE-2024-12287 | Biagiotti Membership Plugin up to 1.0.2 on WordPress biagiotti_membership_check_facebook_user improper authentication
- CVE-2024-11295 | Simple Page Access Restriction Plugin up to 1.0.29 on WordPress access control
- CVE-2024-11614 | DPDK Vhost Library Checksum Offload out-of-bounds (Nessus ID 213102)
- CVE-2024-55648 | Moodle up to 4.1.14/4.3.8/4.4.4/4.5.0 Guest Session session expiration
- CVE-2024-54662 | Dante 1.4.0/1.4.1/1.4.2/1.4.3 Configuration sockd.conf access control
- CVE-2024-49817 | IBM Security Guardium Key Lifecycle Manager 4.1/4.1.1/4.2.0/4.2.1 password in configuration file
- CVE-2024-49816 | IBM Security Guardium Key Lifecycle Manager 4.1/4.1.1/4.2.0/4.2.1 log file
- CVE-2024-56139 | leonhad pdftools up to 0.5.0 Epub stack-based overflow (GHSA-hgvf-4pf3-fwc9)
- CVE-2024-51479 | vercel next.js up to 14.2.14 improper authorization (GHSA-7gfc-8cq8-jh5f)
- CVE-2024-49820 | IBM Security Guardium Key Lifecycle Manager 4.1/4.1.1/4.2.0/4.2.1 cleartext transmission
- CVE-2024-42194 | HCL BigFix Inventory 9.x/10.x REST API insufficient permissions or privileges (KB0118212)
- CVE-2024-55496 | 1000 Projects Bookstore Management System 1.0 add_company.php delete sql injection
- CVE-2024-49818 | IBM Security Guardium Key Lifecycle Manager 4.1/4.1.1/4.2.0/4.2.1 information exposure
- CVE-2024-39703 | ThreatQuotient ThreatQ Platform up to 5.29.2 API Endpoint command injection (icsa-24-352-01)
- CVE-2024-12373 | Rockwell Automation PowerMonitor 1000 Remote buffer overflow (icsa-24-352-03)
- CVE-2024-12372 | Rockwell Automation PowerMonitor 1000 Remote heap-based overflow (icsa-24-352-03)
- CVE-2024-12371 | Rockwell Automation PowerMonitor 1000 Remote API unprotected alternate channel (icsa-24-352-03)
- CVE-2024-11748 | Taeggie Feed Plugin up to 0.1.9 on WordPress cross site scripting
- CVE-2024-12500 | Philantro Plugin up to 5.2 on WordPress cross site scripting
- CVE-2024-12449 | Video Share VOD Plugin up to 2.6.30 on WordPress cross site scripting
- CVE-2024-12596 | LifterLMS Plugin up to 7.8.5 on WordPress authorization
- CVE-2024-12432 | WPC Shop as a Customer for WooCommerce Plugin up to 1.2.8 on WordPress improper authentication
- CVE-2024-12513 | Contests by Rewards Fuel Plugin up to 2.0.65 on WordPress cross site scripting
- CVE-2024-11439 | ScanCircle Plugin up to 2.9.2 on WordPress cross site scripting
- CVE-2024-11881 | Easy Waveform Player Plugin up to 1.2.0 on WordPress cross site scripting
- CVE-2024-12250 | Accept Authorize.NET Payments Using Contact Form 7 Plugin information disclosure
- CVE-2024-12061 | Events Addon for Elementor Plugin up to 2.2.3 on WordPress information disclosure
- CVE-2024-12025 | Collapsing Categories Plugin up to 3.0.8 on WordPress sql injection