2024 CVEs (page 10)
Page 10 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38524 | Medium | 5.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletReques… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2024-29198 | High | 7.5 | 2025-06-10 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Fo… |
CVE-2024-13090 | High | 7.0 | 2025-06-10 | A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local service account were exce… |
CVE-2024-13089 | High | 7.2 | 2025-06-10 | An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. … |
CVE-2024-47081 | Medium | 5.3 | 2025-06-09 | Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously… |
CVE-2024-46452 | Medium | 6.1 | 2025-06-09 | A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim user… |
CVE-2024-55585 | | 2025-06-07 | In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write… | |
CVE-2024-9994 | Medium | 6.4 | 2025-06-07 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-9993 | Medium | 6.4 | 2025-06-07 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-56805 | Medium | 5.4 | 2025-06-06 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attacker… |
CVE-2024-50406 | Medium | 5.4 | 2025-06-06 | A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have ga… |
CVE-2024-13088 | High | 7.8 | 2025-06-06 | An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability… |
CVE-2024-13087 | Medium | 6.7 | 2025-06-06 | A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, t… |
CVE-2024-58114 | Medium | 4.0 | 2025-06-06 | Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-46941 | | 2025-06-06 | SystemUI has an incorrect component protection setting, which allows access to specific information. | |
CVE-2024-56343 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow an authenticated user to crash the service with a specially crafted POST request. |
CVE-2024-56342 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is r… |
CVE-2024-22330 | Medium | 5.9 | 2025-06-06 | IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise us… |
CVE-2024-13967 | High | 8.8 | 2025-06-04 | This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. … |
CVE-2024-31127 | High | 7.3 | 2025-06-04 | An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges. |
CVE-2024-45655 | Medium | 5.5 | 2025-06-03 | IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. |
CVE-2024-12718 | Medium | 5.3 | 2025-06-03 | Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction direc… |
CVE-2024-54189 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-52561 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-36486 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When… |
CVE-2024-53026 | High | 8.2 | 2025-06-03 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. |
CVE-2024-53021 | High | 8.2 | 2025-06-03 | Information disclosure may occur while processing goodbye RTCP packet from network. |
CVE-2024-53020 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. |
CVE-2024-53019 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources. |
CVE-2024-53018 | Medium | 6.6 | 2025-06-03 | Memory corruption may occur while processing the OIS packet parser. |
CVE-2024-53017 | Medium | 6.6 | 2025-06-03 | Memory corruption while handling test pattern generator IOCTL command. |
CVE-2024-53016 | Medium | 6.6 | 2025-06-03 | Memory corruption while processing I2C settings in Camera driver. |
CVE-2024-53015 | Medium | 6.6 | 2025-06-03 | Memory corruption while processing IOCTL command to handle buffers associated with a session. |
CVE-2024-53013 | Medium | 6.6 | 2025-06-03 | Memory corruption may occur while processing voice call registration with user. |
CVE-2024-53010 | High | 7.8 | 2025-06-03 | Memory corruption may occur while attaching VM when the HLOS retains access to VM. |
CVE-2024-8008 | Medium | 5.2 | 2025-06-02 | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JD… |
CVE-2024-7074 | Medium | 6.8 | 2025-06-02 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with… |
CVE-2024-7073 | Medium | 6.5 | 2025-06-02 | A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows u… |
CVE-2024-3509 | Medium | 4.3 | 2025-06-02 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich T… |
CVE-2024-1440 | Medium | 5.4 | 2025-06-02 | An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi… |
CVE-2024-57459 | High | 7.3 | 2025-06-02 | A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate us… |
CVE-2024-40114 | Medium | 6.1 | 2025-06-02 | A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language coo… |
CVE-2024-40113 | Medium | 6.5 | 2025-06-02 | Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials. |
CVE-2024-40112 | Medium | 5.9 | 2025-06-02 | A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate th… |
CVE-2024-54028 | High | 8.4 | 2025-06-02 | An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-ba… |
CVE-2024-52035 | High | 8.4 | 2025-06-02 | An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can… |
CVE-2024-48877 | High | 8.4 | 2025-06-02 | A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed… |
CVE-2024-57783 | High | 8.1 | 2025-06-02 | The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTM… |
CVE-2024-12168 | High | 7.8 | 2025-06-02 | Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used. |
CVE-2024-11857 | High | 7.8 | 2025-06-02 | Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as… |
CVE-2024-42191 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2024-42190 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2024-23589 | Medium | 6.8 | 2025-05-30 | Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using moder… |
CVE-2024-13917 | | 2025-05-30 | An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by u… | |
CVE-2024-13916 | | 2025-05-30 | An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by u… | |
CVE-2024-13915 | | 2025-05-30 | Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing pr… | |
CVE-2024-7097 | Medium | 4.3 | 2025-05-30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles… |
CVE-2024-7096 | Medium | 4.2 | 2025-05-30 | A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new u… |
CVE-2024-12224 | High | 8.8 | 2025-05-30 | Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a… |
CVE-2024-54952 | High | 7.5 | 2025-05-29 | MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending speci… |
CVE-2024-49350 | Medium | 6.5 | 2025-05-29 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a d… |
CVE-2024-53423 | Medium | 5.6 | 2025-05-29 | An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets. |
CVE-2024-51392 | High | 8.8 | 2025-05-29 | An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component |
CVE-2024-22654 | High | 7.5 | 2025-05-29 | tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c. |
CVE-2024-22653 | Medium | 4.8 | 2025-05-29 | yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c. |
CVE-2024-52588 | Medium | 4.9 | 2025-05-29 | Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetc… |
CVE-2024-57338 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to exec… |
CVE-2024-57337 | Medium | 6.5 | 2025-05-28 | An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8… |
CVE-2024-57336 | Medium | 6.5 | 2025-05-28 | Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator… |
CVE-2024-47057 | Medium | 5.3 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by… |
CVE-2024-47055 | Medium | 4.3 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated use… |
CVE-2024-47056 | Medium | 5.1 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This e… |
CVE-2024-51453 | Medium | 4.3 | 2025-05-28 | IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially craft… |
CVE-2024-38341 | Medium | 5.9 | 2025-05-28 | IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that… |
CVE-2024-54020 | Low | 2.3 | 2025-05-28 | A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrit… |
CVE-2024-45094 | Medium | 5.5 | 2025-05-27 | IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arb… |
CVE-2024-11185 | Medium | 6.5 | 2025-05-27 | On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with diff… |
CVE-2024-13966 | High | 7.3 | 2025-05-27 | ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users… |
CVE-2024-49197 | Medium | 6.5 | 2025-05-27 | An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack… |
CVE-2024-49196 | High | 7.5 | 2025-05-27 | An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service. |
CVE-2024-56193 | Medium | 5.1 | 2025-05-27 | There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional exe… |
CVE-2024-47090 | Medium | 6.1 | 2025-05-27 | Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS |
CVE-2024-38866 | High | 7.5 | 2025-05-27 | Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection |
CVE-2024-13427 | Medium | 6.4 | 2025-05-24 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in… |
CVE-2024-51102 | Medium | 4.4 | 2025-05-23 | PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via… |
CVE-2024-51103 | Medium | 6.5 | 2025-05-23 | PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recov… |
CVE-2024-51099 | Medium | 6.1 | 2025-05-23 | A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation System using PHP an… |
CVE-2024-48704 | Medium | 6.1 | 2025-05-23 | Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes. |
CVE-2024-51360 | Critical | 9.8 | 2025-05-23 | An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file |
CVE-2024-51108 | Medium | 5.4 | 2025-05-23 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Generation System using P… |
CVE-2024-51107 | Medium | 4.8 | 2025-05-23 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP an… |
CVE-2024-51101 | Critical | 9.8 | 2025-05-23 | PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rt… |
CVE-2024-48702 | Medium | 5.4 | 2025-05-23 | PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter. |
CVE-2024-9163 | Low | 3.5 | 2025-05-23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an att… |
CVE-2024-7803 | Medium | 6.5 | 2025-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook i… |
CVE-2024-13945 | Medium | 6.0 | 2025-05-23 | Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPE… |
CVE-2024-5962 | Medium | 6.1 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-sup… |
CVE-2024-7487 | Medium | 5.8 | 2025-05-22 | An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypasse… |
CVE-2024-7103 | Medium | 4.6 | 2025-05-22 | A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation… |