2024 CVEs (page 113)
Page 113 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10971 | Medium | 4.3 | 2024-11-12 | Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data… |
CVE-2024-8074 | | 2024-11-12 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. Th… | |
CVE-2024-51566 | Medium | 6.5 | 2024-11-12 | The NVMe driver queue processing is vulernable to guest-induced infinite loops. |
CVE-2024-51565 | Medium | 6.5 | 2024-11-12 | The hda driver is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-51564 | High | 7.5 | 2024-11-12 | A guest can trigger an infinite loop in the hda audio driver. |
CVE-2024-51563 | Medium | 6.5 | 2024-11-12 | The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition. |
CVE-2024-51562 | Medium | 6.5 | 2024-11-12 | The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-50386 | High | 8.5 | 2024-11-12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due t… |
CVE-2024-45289 | High | 7.5 | 2024-11-12 | The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by… |
CVE-2024-42442 | High | 7.2 | 2024-11-12 | APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over… |
CVE-2024-39281 | Medium | 5.3 | 2024-11-12 | The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. |
CVE-2024-37365 | High | 7.3 | 2024-11-12 | A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyo… |
CVE-2024-33660 | Medium | 4.3 | 2024-11-12 | An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. |
CVE-2024-33658 | High | 7.8 | 2024-11-12 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Succes… |
CVE-2024-2315 | High | 7.1 | 2024-11-12 | APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to… |
CVE-2024-11130 | Low | 2.4 | 2024-11-12 | A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.ph… |
CVE-2024-11127 | Medium | 6.3 | 2024-11-12 | A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-11126 | Low | 3.1 | 2024-11-12 | A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The… |
CVE-2024-11125 | Medium | 4.3 | 2024-11-12 | A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The… |
CVE-2024-11124 | Medium | 4.7 | 2024-11-12 | A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/… |
CVE-2024-50572 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50561 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50560 | Low | 3.1 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50559 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50558 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50557 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50313 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mend… |
CVE-2024-50310 | High | 7.5 | 2024-11-12 | A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions >= V4.0.44 < V4.0.50). Affected devices do not properly handle… |
CVE-2024-47942 | High | 7.3 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications suffer from a DLL hijacking vulnerability… |
CVE-2024-47941 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end… |
CVE-2024-47940 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end… |
CVE-2024-47808 | High | 8.4 | 2024-11-12 | A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restr… |
CVE-2024-47783 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. … |
CVE-2024-46894 | Medium | 6.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a use… |
CVE-2024-46892 | Medium | 4.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the as… |
CVE-2024-46891 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated… |
CVE-2024-46890 | Critical | 9.1 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific… |
CVE-2024-46889 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obf… |
CVE-2024-46888 | Critical | 9.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths fo… |
CVE-2024-44102 | Critical | 10.0 | 2024-11-12 | A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured)… |
CVE-2024-36140 | Medium | 6.8 | 2024-11-12 | A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to s… |
CVE-2024-29119 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow… |
CVE-2024-11123 | Medium | 4.3 | 2024-11-12 | A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/… |
CVE-2024-11122 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functional… |
CVE-2024-11121 | Medium | 6.3 | 2024-11-12 | A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-10245 | Critical | 9.8 | 2024-11-12 | The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and c… |
CVE-2024-10323 | Medium | 6.4 | 2024-11-12 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and includi… |
CVE-2024-10179 | Medium | 6.4 | 2024-11-12 | The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all vers… |
CVE-2024-9836 | Medium | 5.9 | 2024-11-12 | The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-9835 | Medium | 4.8 | 2024-11-12 | The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could… |
CVE-2024-9357 | Medium | 6.1 | 2024-11-12 | The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.0… |
CVE-2024-47799 | Low | 3.5 | 2024-11-12 | Exposure of sensitive system information to an unauthorized control sphere issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If thi… |
CVE-2024-45827 | High | 8.0 | 2024-11-12 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and… |
CVE-2024-29075 | Medium | 4.6 | 2024-11-12 | Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent… |
CVE-2024-10790 | Medium | 5.4 | 2024-11-12 | The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2024-49560 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with… |
CVE-2024-49558 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged… |
CVE-2024-49557 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48838 | Low | 3.3 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerabili… |
CVE-2024-48837 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low pri… |
CVE-2024-11102 | Low | 3.5 | 2024-11-12 | A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functional… |
CVE-2024-11101 | Medium | 4.7 | 2024-11-12 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2024-11100 | High | 7.3 | 2024-11-12 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10695 | Medium | 4.3 | 2024-11-12 | The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcod… |
CVE-2024-10685 | Medium | 6.1 | 2024-11-12 | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to… |
CVE-2024-10672 | Low | 2.7 | 2024-11-12 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upse… |
CVE-2024-10538 | Medium | 6.4 | 2024-11-12 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image Comparison widget… |
CVE-2024-49395 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. |
CVE-2024-49394 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed em… |
CVE-2024-8882 | Medium | 4.5 | 2024-11-12 | A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN… |
CVE-2024-8881 | Medium | 6.8 | 2024-11-12 | A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow… |
CVE-2024-49393 | Medium | 6.5 | 2024-11-12 | In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their… |
CVE-2024-11099 | High | 7.3 | 2024-11-12 | A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. T… |
CVE-2024-11097 | Low | 3.3 | 2024-11-12 | A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2024-47595 | Medium | 6.3 | 2024-11-12 | An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacke… |
CVE-2024-47593 | Medium | 4.3 | 2024-11-12 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted… |
CVE-2024-47592 | Medium | 5.3 | 2024-11-12 | SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impac… |
CVE-2024-47590 | High | 8.8 | 2024-11-12 | An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, inp… |
CVE-2024-47588 | Medium | 4.7 | 2024-11-12 | In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext t… |
CVE-2024-47587 | Low | 3.5 | 2024-11-12 | Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confident… |
CVE-2024-47586 | Medium | 5.3 | 2024-11-12 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a n… |
CVE-2024-42372 | Medium | 6.5 | 2024-11-12 | Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD co… |
CVE-2024-11096 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The m… |
CVE-2024-11079 | Medium | 5.5 | 2024-11-12 | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute t… |
CVE-2024-52533 | Critical | 9.8 | 2024-11-11 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trail… |
CVE-2024-51213 | Medium | 6.1 | 2024-11-11 | Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component. |
CVE-2024-50636 | Critical | 9.8 | 2024-11-11 | PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers ca… |
CVE-2024-50601 | Medium | 6.1 | 2024-11-11 | Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execut… |
CVE-2024-25255 | Critical | 9.8 | 2024-11-11 | Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties report that this is in… |
CVE-2024-25254 | Critical | 9.8 | 2024-11-11 | SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. |
CVE-2024-25253 | High | 7.5 | 2024-11-11 | Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module. |
CVE-2024-23983 | | 2024-11-11 | Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. | |
CVE-2024-51026 | Medium | 5.4 | 2024-11-11 | The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is possible to inject a… |
CVE-2024-46966 | High | 8.1 | 2024-11-11 | The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript cod… |
CVE-2024-46964 | High | 8.1 | 2024-11-11 | The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the c… |
CVE-2024-46963 | High | 8.1 | 2024-11-11 | The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbi… |
CVE-2024-46962 | Critical | 9.1 | 2024-11-11 | The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via… |
CVE-2024-44546 | Critical | 9.8 | 2024-11-11 | Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. |
CVE-2024-52532 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. |
CVE-2024-52531 | Medium | 6.5 | 2024-11-11 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausib… |