2024 CVEs (page 11)
Page 11 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2024-51553 | Medium | 6.5 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-51552 | Medium | 6.0 | 2025-05-22 | Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS S… |
CVE-2024-48848 | Medium | 6.5 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-41199 | High | 7.2 | 2025-05-22 | An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP… |
CVE-2024-41198 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pac… |
CVE-2024-41197 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pa… |
CVE-2024-41196 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TC… |
CVE-2024-41195 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a craft… |
CVE-2024-40462 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component |
CVE-2024-40461 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component |
CVE-2024-40460 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE |
CVE-2024-40459 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function |
CVE-2024-40458 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets. |
CVE-2024-13958 | Medium | 4.8 | 2025-05-22 | Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13957 | High | 7.6 | 2025-05-22 | SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3… |
CVE-2024-13956 | Medium | 6.7 | 2025-05-22 | SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS… |
CVE-2024-13955 | High | 8.8 | 2025-05-22 | 2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become comprom… |
CVE-2024-13954 | Medium | 6.5 | 2025-05-22 | Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterpris… |
CVE-2024-13953 | Medium | 4.9 | 2025-05-22 | Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13952 | High | 8.4 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-13951 | High | 7.6 | 2025-05-22 | One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: thro… |
CVE-2024-13950 | Medium | 6.8 | 2025-05-22 | Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue… |
CVE-2024-13949 | Medium | 6.8 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-13948 | High | 7.3 | 2025-05-22 | Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise… |
CVE-2024-13947 | Medium | 6.0 | 2025-05-22 | Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enter… |
CVE-2024-13946 | Medium | 6.8 | 2025-05-22 | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue… |
CVE-2024-9639 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: thr… |
CVE-2024-52874 | High | 8.8 | 2025-05-22 | In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks. |
CVE-2024-13931 | High | 7.2 | 2025-05-22 | Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects AS… |
CVE-2024-13930 | Medium | 4.9 | 2025-05-22 | An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become comp… |
CVE-2024-13929 | High | 7.2 | 2025-05-22 | Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Ente… |
CVE-2024-13928 | High | 7.2 | 2025-05-22 | SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromis… |
CVE-2024-48853 | Critical | 9.0 | 2025-05-22 | An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue aff… |
CVE-2024-48850 | High | 7.2 | 2025-05-22 | Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2024-54188 | Medium | 5.3 | 2025-05-22 | Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. |
CVE-2024-12093 | Medium | 6.8 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath vali… |
CVE-2024-25010 | High | 8.8 | 2025-05-22 | Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validation could be exploit… |
CVE-2024-9544 | Medium | 6.4 | 2025-05-22 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficie… |
CVE-2024-57529 | Medium | 6.1 | 2025-05-21 | Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary code. |
CVE-2024-56428 | Medium | 5.5 | 2025-05-21 | The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configu… |
CVE-2024-23337 | Medium | 4.3 | 2025-05-21 | jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the s… |
CVE-2024-56429 | High | 7.7 | 2025-05-21 | itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database. |
CVE-2024-42922 | Medium | 6.5 | 2025-05-21 | AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability. |
CVE-2024-12561 | Medium | 6.1 | 2025-05-21 | The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This i… |
CVE-2024-45641 | Medium | 6.5 | 2025-05-20 | IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation. |
CVE-2024-53359 | High | 7.5 | 2025-05-20 | An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. |
CVE-2024-5878 | Medium | 6.4 | 2025-05-20 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in vari… |
CVE-2024-33939 | Medium | 5.3 | 2025-05-19 | Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - L… |
CVE-2024-55063 | High | 8.8 | 2025-05-19 | Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang param… |
CVE-2024-51106 | Medium | 4.6 | 2025-05-19 | A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows… |
CVE-2024-13613 | High | 7.5 | 2025-05-17 | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Thi… |
CVE-2024-47893 | Medium | 6.5 | 2025-05-17 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualis… |
CVE-2024-40120 | Medium | 6.5 | 2025-05-16 | seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go. |
CVE-2024-53827 | High | 7.5 | 2025-05-16 | Ericsson Packet Core Controller (PCC) contains a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degrada… |
CVE-2024-8201 | Medium | 5.4 | 2025-05-16 | Cross-Site WebSocket Hijacking vulnerability in Hitachi Ops Center Analyzer (RAID Agent component).This issue affects Hitachi Ops Center Analyzer: from 10.8.0-… |
CVE-2024-51475 | Medium | 5.4 | 2025-05-16 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2024-9882 | Medium | 4.8 | 2025-05-15 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its set… |
CVE-2024-9879 | Medium | 5.4 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2024-9838 | Medium | 5.4 | 2025-05-15 | The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform… |
CVE-2024-9831 | High | 7.2 | 2025-05-15 | The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inje… |
CVE-2024-9765 | Medium | 6.5 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory |
CVE-2024-9711 | Medium | 5.4 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2024-9709 | Medium | 5.4 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2024-9663 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9662 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9645 | Medium | 5.4 | 2025-05-15 | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options be… |
CVE-2024-9599 | Medium | 5.4 | 2025-05-15 | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-9450 | Medium | 6.5 | 2025-05-15 | The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, w… |
CVE-2024-9390 | Medium | 4.8 | 2025-05-15 | The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-9238 | Medium | 5.4 | 2025-05-15 | The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a maliciou… |
CVE-2024-9236 | Medium | 4.8 | 2025-05-15 | The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-9233 | Medium | 4.3 | 2025-05-15 | The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-9227 | Medium | 4.8 | 2025-05-15 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which coul… |
CVE-2024-9182 | Medium | 4.8 | 2025-05-15 | The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cr… |
CVE-2024-8854 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8851 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8759 | Medium | 4.8 | 2025-05-15 | The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-8703 | Medium | 6.1 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated… |
CVE-2024-8702 | Medium | 4.8 | 2025-05-15 | The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-8701 | Medium | 4.8 | 2025-05-15 | The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8700 | High | 7.5 | 2025-05-15 | The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calend… |
CVE-2024-8699 | High | 7.2 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files… |
CVE-2024-8673 | Critical | 9.1 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. |
CVE-2024-8670 | Medium | 4.8 | 2025-05-15 | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8620 | Medium | 4.8 | 2025-05-15 | The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8619 | Medium | 4.8 | 2025-05-15 | The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8618 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8617 | Medium | 4.8 | 2025-05-15 | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perfo… |
CVE-2024-8542 | Medium | 4.8 | 2025-05-15 | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8493 | Medium | 4.8 | 2025-05-15 | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-8492 | Medium | 4.8 | 2025-05-15 | The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform… |
CVE-2024-8426 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8398 | Medium | 4.3 | 2025-05-15 | The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-8397 | Medium | 5.4 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to co… |
CVE-2024-8286 | Medium | 6.5 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a… |
CVE-2024-8284 | Medium | 4.8 | 2025-05-15 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors t… |
CVE-2024-8245 | Medium | 4.3 | 2025-05-15 | The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2024-8187 | Medium | 4.8 | 2025-05-15 | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8095 | Medium | 6.1 | 2025-05-15 | The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |