2024 CVEs (page 10)
Page 10 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53015 | Medium | 6.6 | 2025-06-03 | Memory corruption while processing IOCTL command to handle buffers associated with a session. |
CVE-2024-53013 | Medium | 6.6 | 2025-06-03 | Memory corruption may occur while processing voice call registration with user. |
CVE-2024-53010 | High | 7.8 | 2025-06-03 | Memory corruption may occur while attaching VM when the HLOS retains access to VM. |
CVE-2024-8008 | Medium | 5.2 | 2025-06-02 | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JD… |
CVE-2024-7074 | Medium | 6.8 | 2025-06-02 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with… |
CVE-2024-7073 | Medium | 6.5 | 2025-06-02 | A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows u… |
CVE-2024-3509 | Medium | 4.3 | 2025-06-02 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich T… |
CVE-2024-1440 | Medium | 5.4 | 2025-06-02 | An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi… |
CVE-2024-57459 | High | 7.3 | 2025-06-02 | A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate us… |
CVE-2024-40114 | Medium | 6.1 | 2025-06-02 | A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language coo… |
CVE-2024-40113 | Medium | 6.5 | 2025-06-02 | Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials. |
CVE-2024-40112 | Medium | 5.9 | 2025-06-02 | A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate th… |
CVE-2024-54028 | High | 8.4 | 2025-06-02 | An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-ba… |
CVE-2024-52035 | High | 8.4 | 2025-06-02 | An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can… |
CVE-2024-48877 | High | 8.4 | 2025-06-02 | A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed… |
CVE-2024-57783 | High | 8.1 | 2025-06-02 | The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTM… |
CVE-2024-12168 | High | 7.8 | 2025-06-02 | Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used. |
CVE-2024-11857 | High | 7.8 | 2025-06-02 | Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as… |
CVE-2024-42191 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2024-42190 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2024-23589 | Medium | 6.8 | 2025-05-30 | Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using moder… |
CVE-2024-13917 | | 2025-05-30 | An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by u… | |
CVE-2024-13916 | | 2025-05-30 | An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by u… | |
CVE-2024-13915 | | 2025-05-30 | Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing pr… | |
CVE-2024-7097 | Medium | 4.3 | 2025-05-30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles… |
CVE-2024-7096 | Medium | 4.2 | 2025-05-30 | A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new u… |
CVE-2024-12224 | High | 8.8 | 2025-05-30 | Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a… |
CVE-2024-54952 | High | 7.5 | 2025-05-29 | MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending speci… |
CVE-2024-49350 | Medium | 6.5 | 2025-05-29 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a d… |
CVE-2024-53423 | Medium | 5.6 | 2025-05-29 | An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets. |
CVE-2024-51392 | High | 8.8 | 2025-05-29 | An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component |
CVE-2024-22654 | High | 7.5 | 2025-05-29 | tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c. |
CVE-2024-22653 | Medium | 4.8 | 2025-05-29 | yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c. |
CVE-2024-52588 | Medium | 4.9 | 2025-05-29 | Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetc… |
CVE-2024-57338 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to exec… |
CVE-2024-57337 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8… |
CVE-2024-57336 | Medium | 6.5 | 2025-05-28 | Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator… |
CVE-2024-47057 | Medium | 5.3 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by… |
CVE-2024-47055 | Medium | 4.3 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated use… |
CVE-2024-47056 | Medium | 5.1 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This e… |
CVE-2024-51453 | Medium | 4.3 | 2025-05-28 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially craft… |
CVE-2024-38341 | Medium | 5.9 | 2025-05-28 | IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that… |
CVE-2024-54020 | Low | 2.3 | 2025-05-28 | A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrit… |
CVE-2024-45094 | Medium | 5.5 | 2025-05-27 | IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arb… |
CVE-2024-11185 | Medium | 6.5 | 2025-05-27 | On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with diff… |
CVE-2024-13966 | High | 7.3 | 2025-05-27 | ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users… |
CVE-2024-49197 | Medium | 6.5 | 2025-05-27 | An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack… |
CVE-2024-49196 | High | 7.5 | 2025-05-27 | An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service. |
CVE-2024-56193 | Medium | 5.1 | 2025-05-27 | There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional exe… |
CVE-2024-47090 | Medium | 6.1 | 2025-05-27 | Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS |
CVE-2024-38866 | High | 7.5 | 2025-05-27 | Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection |
CVE-2024-13427 | Medium | 6.4 | 2025-05-24 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in… |
CVE-2024-51102 | Medium | 4.4 | 2025-05-23 | PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via… |
CVE-2024-51103 | Medium | 6.5 | 2025-05-23 | PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recov… |
CVE-2024-51099 | Medium | 6.1 | 2025-05-23 | A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation System using PHP an… |
CVE-2024-48704 | Medium | 6.1 | 2025-05-23 | Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes. |
CVE-2024-51360 | Critical | 9.8 | 2025-05-23 | An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file |
CVE-2024-51108 | Medium | 5.4 | 2025-05-23 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Generation System using P… |
CVE-2024-51107 | Medium | 4.8 | 2025-05-23 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP an… |
CVE-2024-51101 | Critical | 9.8 | 2025-05-23 | PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rt… |
CVE-2024-48702 | Medium | 5.4 | 2025-05-23 | PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter. |
CVE-2024-9163 | Low | 3.5 | 2025-05-23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an att… |
CVE-2024-7803 | Medium | 6.5 | 2025-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook i… |
CVE-2024-13945 | Medium | 6.0 | 2025-05-23 | Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPE… |
CVE-2024-5962 | Medium | 6.1 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-sup… |
CVE-2024-7487 | Medium | 5.8 | 2025-05-22 | An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypasse… |
CVE-2024-7103 | Medium | 4.6 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2024-51553 | Medium | 6.5 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-51552 | Medium | 6.0 | 2025-05-22 | Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS S… |
CVE-2024-48848 | Medium | 6.5 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-41199 | High | 7.2 | 2025-05-22 | An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP… |
CVE-2024-41198 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pac… |
CVE-2024-41197 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pa… |
CVE-2024-41196 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TC… |
CVE-2024-41195 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a craft… |
CVE-2024-40462 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component |
CVE-2024-40461 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component |
CVE-2024-40460 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE |
CVE-2024-40459 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function |
CVE-2024-40458 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets. |
CVE-2024-13958 | Medium | 4.8 | 2025-05-22 | Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13957 | High | 7.6 | 2025-05-22 | SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3… |
CVE-2024-13956 | Medium | 6.7 | 2025-05-22 | SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS… |
CVE-2024-13955 | High | 8.8 | 2025-05-22 | 2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become comprom… |
CVE-2024-13954 | Medium | 6.5 | 2025-05-22 | Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterpris… |
CVE-2024-13953 | Medium | 4.9 | 2025-05-22 | Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13952 | High | 8.4 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-13951 | High | 7.6 | 2025-05-22 | One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: thro… |
CVE-2024-13950 | Medium | 6.8 | 2025-05-22 | Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue… |
CVE-2024-13949 | Medium | 6.8 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-13948 | High | 7.3 | 2025-05-22 | Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise… |
CVE-2024-13947 | Medium | 6.0 | 2025-05-22 | Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enter… |
CVE-2024-13946 | Medium | 6.8 | 2025-05-22 | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue… |
CVE-2024-9639 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: thr… |
CVE-2024-52874 | High | 8.8 | 2025-05-22 | In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks. |
CVE-2024-13931 | High | 7.2 | 2025-05-22 | Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects AS… |
CVE-2024-13930 | Medium | 4.9 | 2025-05-22 | An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become comp… |
CVE-2024-13929 | High | 7.2 | 2025-05-22 | Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Ente… |
CVE-2024-13928 | High | 7.2 | 2025-05-22 | SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromis… |