2024 CVEs (page 113)
Page 113 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10944 | High | 8.4 | 2024-11-12 | A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input v… |
CVE-2024-10943 | Critical | 9.1 | 2024-11-12 | An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat … |
CVE-2024-10923 | | 2024-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ ALM Octane Management allows Stored XSS… | |
CVE-2024-9420 | High | 8.8 | 2024-11-12 | A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-8495 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated at… |
CVE-2024-52297 | Critical | 9.8 | 2024-11-12 | Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users… |
CVE-2024-52296 | Medium | 6.5 | 2024-11-12 | libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. At ospd_… |
CVE-2024-50331 | High | 7.5 | 2024-11-12 | An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory. |
CVE-2024-50330 | Critical | 9.8 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to… |
CVE-2024-50329 | High | 8.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to… |
CVE-2024-50328 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50327 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50326 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50324 | High | 7.2 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50323 | High | 7.8 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to a… |
CVE-2024-50322 | High | 7.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-50321 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50320 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50319 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50318 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50317 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-47909 | Medium | 4.9 | 2024-11-12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated a… |
CVE-2024-47907 | High | 7.5 | 2024-11-12 | A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-47906 | High | 7.8 | 2024-11-12 | Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Ap… |
CVE-2024-47905 | Medium | 4.9 | 2024-11-12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated a… |
CVE-2024-47535 | Medium | 5.5 | 2024-11-12 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsaf… |
CVE-2024-43415 | Critical | 9.0 | 2024-11-12 | An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allow… |
CVE-2024-11007 | Critical | 9.1 | 2024-11-12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable t… |
CVE-2024-10971 | Medium | 4.3 | 2024-11-12 | Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data… |
CVE-2024-8074 | | 2024-11-12 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. Th… | |
CVE-2024-51566 | Medium | 6.5 | 2024-11-12 | The NVMe driver queue processing is vulernable to guest-induced infinite loops. |
CVE-2024-51565 | Medium | 6.5 | 2024-11-12 | The hda driver is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-51564 | High | 7.5 | 2024-11-12 | A guest can trigger an infinite loop in the hda audio driver. |
CVE-2024-51563 | Medium | 6.5 | 2024-11-12 | The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition. |
CVE-2024-51562 | Medium | 6.5 | 2024-11-12 | The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value. |
CVE-2024-50386 | High | 8.5 | 2024-11-12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due t… |
CVE-2024-45289 | High | 7.5 | 2024-11-12 | The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by… |
CVE-2024-42442 | High | 7.2 | 2024-11-12 | APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over… |
CVE-2024-39281 | Medium | 5.3 | 2024-11-12 | The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator. |
CVE-2024-37365 | High | 7.3 | 2024-11-12 | A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyo… |
CVE-2024-33660 | Medium | 4.3 | 2024-11-12 | An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. |
CVE-2024-33658 | High | 7.8 | 2024-11-12 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Succes… |
CVE-2024-2315 | High | 7.1 | 2024-11-12 | APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to… |
CVE-2024-11130 | Low | 2.4 | 2024-11-12 | A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.ph… |
CVE-2024-11127 | Medium | 6.3 | 2024-11-12 | A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-11126 | Low | 3.1 | 2024-11-12 | A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The… |
CVE-2024-11125 | Medium | 4.3 | 2024-11-12 | A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The… |
CVE-2024-11124 | Medium | 4.7 | 2024-11-12 | A vulnerability has been found in TimGeyssens UIOMatic 5 and classified as critical. This vulnerability affects unknown code of the file /src/UIOMatic/wwwroot/… |
CVE-2024-50572 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50561 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50560 | Low | 3.1 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50559 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50558 | Medium | 4.3 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50557 | High | 7.2 | 2024-11-12 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-50313 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mend… |
CVE-2024-50310 | High | 7.5 | 2024-11-12 | A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions >= V4.0.44 < V4.0.50). Affected devices do not properly handle… |
CVE-2024-47942 | High | 7.3 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications suffer from a DLL hijacking vulnerability… |
CVE-2024-47941 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end… |
CVE-2024-47940 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end… |
CVE-2024-47808 | High | 8.4 | 2024-11-12 | A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restr… |
CVE-2024-47783 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. … |
CVE-2024-46894 | Medium | 6.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a use… |
CVE-2024-46892 | Medium | 4.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the as… |
CVE-2024-46891 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated… |
CVE-2024-46890 | Critical | 9.1 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific… |
CVE-2024-46889 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obf… |
CVE-2024-46888 | Critical | 9.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths fo… |
CVE-2024-44102 | Critical | 10.0 | 2024-11-12 | A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured)… |
CVE-2024-36140 | Medium | 6.8 | 2024-11-12 | A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to s… |
CVE-2024-29119 | High | 7.8 | 2024-11-12 | A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow… |
CVE-2024-11123 | Medium | 4.3 | 2024-11-12 | A vulnerability, which was classified as problematic, was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. This affects an unknown part of the file /crm/data/… |
CVE-2024-11122 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functional… |
CVE-2024-11121 | Medium | 6.3 | 2024-11-12 | A vulnerability classified as critical was found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-10245 | Critical | 9.8 | 2024-11-12 | The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and c… |
CVE-2024-10323 | Medium | 6.4 | 2024-11-12 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and includi… |
CVE-2024-10179 | Medium | 6.4 | 2024-11-12 | The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all vers… |
CVE-2024-9836 | Medium | 5.9 | 2024-11-12 | The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-9835 | Medium | 4.8 | 2024-11-12 | The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could… |
CVE-2024-9357 | Medium | 6.1 | 2024-11-12 | The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.0… |
CVE-2024-47799 | Low | 3.5 | 2024-11-12 | Exposure of sensitive system information to an unauthorized control sphere issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If thi… |
CVE-2024-45827 | High | 8.0 | 2024-11-12 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and… |
CVE-2024-29075 | Medium | 4.6 | 2024-11-12 | Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent… |
CVE-2024-10790 | Medium | 5.4 | 2024-11-12 | The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includi… |
CVE-2024-49560 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with… |
CVE-2024-49558 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged… |
CVE-2024-49557 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48838 | Low | 3.3 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerabili… |
CVE-2024-48837 | High | 7.8 | 2024-11-12 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low pri… |
CVE-2024-11102 | Low | 3.5 | 2024-11-12 | A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functional… |
CVE-2024-11101 | Medium | 4.7 | 2024-11-12 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2024-11100 | High | 7.3 | 2024-11-12 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10695 | Medium | 4.3 | 2024-11-12 | The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcod… |
CVE-2024-10685 | Medium | 6.1 | 2024-11-12 | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to… |
CVE-2024-10672 | Low | 2.7 | 2024-11-12 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upse… |
CVE-2024-10538 | Medium | 6.4 | 2024-11-12 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image Comparison widget… |
CVE-2024-49395 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. |
CVE-2024-49394 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed em… |
CVE-2024-8882 | Medium | 4.5 | 2024-11-12 | A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN… |
CVE-2024-8881 | Medium | 6.8 | 2024-11-12 | A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow… |
CVE-2024-49393 | Medium | 6.5 | 2024-11-12 | In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their… |