2024 CVEs (page 13)
Page 13 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45067 | High | 8.2 | 2025-05-14 | Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalatio… |
CVE-2024-56427 | Medium | 6.5 | 2025-05-14 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W9… |
CVE-2024-55569 | High | 7.5 | 2025-05-14 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110… |
CVE-2024-58101 | High | 8.1 | 2025-05-14 | Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio p… |
CVE-2024-57096 | Medium | 5.5 | 2025-05-14 | An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. |
CVE-2024-45516 | Medium | 6.1 | 2025-05-14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-S… |
CVE-2024-56157 | Medium | 6.3 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack c… |
CVE-2024-52601 | Medium | 6.5 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access t… |
CVE-2024-10865 | | 2025-05-14 | Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication ve… | |
CVE-2024-10864 | | 2025-05-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication. This issue affects Adva… | |
CVE-2024-57273 | Medium | 5.4 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backu… |
CVE-2024-54780 | High | 8.8 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper saniti… |
CVE-2024-54779 | Medium | 5.4 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. |
CVE-2024-24780 | Critical | 9.8 | 2025-05-14 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function fro… |
CVE-2024-8988 | Medium | 5.3 | 2025-05-14 | The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file… |
CVE-2024-13940 | Medium | 5.5 | 2025-05-14 | The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook fun… |
CVE-2024-52290 | Medium | 6.3 | 2025-05-14 | LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate th… |
CVE-2024-48869 | Medium | 6.1 | 2025-05-13 | Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions… |
CVE-2024-47800 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local acc… |
CVE-2024-47795 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potentially enable esc… |
CVE-2024-47550 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-46895 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an authenticated user t… |
CVE-2024-45371 | Medium | 6.7 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated user to potentially e… |
CVE-2024-45333 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to potent… |
CVE-2024-45332 | Medium | 5.6 | 2025-05-13 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for… |
CVE-2024-43420 | Medium | 5.6 | 2025-05-13 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Atom(R) processors may… |
CVE-2024-43101 | Medium | 5.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an authenticated user… |
CVE-2024-39833 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-39758 | Medium | 5.9 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allow an authenticated user to potentially e… |
CVE-2024-36292 | High | 7.3 | 2025-05-13 | Improper buffer restrictions for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to p… |
CVE-2024-31150 | Low | 3.8 | 2025-05-13 | Out-of-bounds read for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2024-31073 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-29222 | Medium | 6.1 | 2025-05-13 | Out-of-bounds write for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-28956 | Medium | 5.6 | 2025-05-13 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated us… |
CVE-2024-28954 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2024-28036 | Medium | 5.6 | 2025-05-13 | Improper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-6364 | Medium | 6.4 | 2025-05-13 | A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to th… |
CVE-2024-36339 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary c… |
CVE-2024-36321 | High | 7.3 | 2025-05-13 | Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution. |
CVE-2024-21960 | High | 7.3 | 2025-05-13 | Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege escalation potenti… |
CVE-2024-56526 | Medium | 4.9 | 2025-05-13 | An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error. |
CVE-2024-48766 | High | 8.6 | 2025-05-13 | NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos an… |
CVE-2024-46506 | Critical | 10.0 | 2025-05-13 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authenticat… |
CVE-2024-35281 | Low | 2.5 | 2025-05-13 | An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and… |
CVE-2024-12533 | Low | 3.3 | 2025-05-13 | Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This issue affects SecureC… |
CVE-2024-42446 | High | 7.5 | 2025-05-13 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-36340 | Medium | 6.6 | 2025-05-13 | A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file d… |
CVE-2024-51447 | Medium | 5.3 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected applica… |
CVE-2024-51446 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected applicat… |
CVE-2024-51445 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External… |
CVE-2024-51444 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user in… |
CVE-2024-23815 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highl… |
CVE-2024-55466 | Medium | 6.5 | 2025-05-12 | An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to… |
CVE-2024-4982 | High | 7.6 | 2025-05-12 | A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secret… |
CVE-2024-4981 | High | 7.6 | 2025-05-12 | A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show… |
CVE-2024-56524 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request. |
CVE-2024-56523 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request bo… |
CVE-2024-8973 | Medium | 6.5 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2024-9524 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in System Speedup Service in Avira Operations GmbH Avira Prime Version 1.1.96.2 on Windows 10 x64 allow… |
CVE-2024-13962 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 a… |
CVE-2024-13961 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attac… |
CVE-2024-13960 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to esca… |
CVE-2024-13959 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges… |
CVE-2024-13944 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows… |
CVE-2024-13759 | High | 7.8 | 2025-05-09 | Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via… |
CVE-2024-12442 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. |
CVE-2024-11861 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access. |
CVE-2024-11617 | Critical | 9.8 | 2025-05-09 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fo… |
CVE-2024-9448 | High | 7.5 | 2025-05-08 | On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rule… |
CVE-2024-8100 | High | 8.7 | 2025-05-08 | On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision. |
CVE-2024-12378 | Critical | 9.1 | 2025-05-08 | On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan t… |
CVE-2024-11186 | Critical | 10.0 | 2025-05-08 | On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS dev… |
CVE-2024-13009 | High | 7.2 | 2025-05-08 | In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result… |
CVE-2024-6648 | High | 7.5 | 2025-05-08 | Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' w… |
CVE-2024-13793 | High | 7.3 | 2025-05-08 | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin… |
CVE-2024-55651 | Medium | 5.4 | 2025-05-08 | i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading… |
CVE-2024-47619 | High | 7.5 | 2025-05-07 | syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It… |
CVE-2024-12120 | Medium | 5.4 | 2025-05-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parame… |
CVE-2024-12225 | Critical | 9.1 | 2025-05-06 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and… |
CVE-2024-49847 | High | 7.5 | 2025-05-06 | Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE. |
CVE-2024-49846 | High | 8.2 | 2025-05-06 | Memory corruption while decoding of OTA messages from T3448 IE. |
CVE-2024-49845 | High | 7.8 | 2025-05-06 | Memory corruption during the FRS UDS generation process. |
CVE-2024-49844 | High | 7.8 | 2025-05-06 | Memory corruption while triggering commands in the PlayReady Trusted application. |
CVE-2024-49842 | High | 7.8 | 2025-05-06 | Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions. |
CVE-2024-49841 | High | 7.8 | 2025-05-06 | Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling. |
CVE-2024-49835 | High | 7.8 | 2025-05-06 | Memory corruption while reading secure file. |
CVE-2024-49830 | Medium | 6.6 | 2025-05-06 | Memory corruption while processing an IOCTL call to set mixer controls. |
CVE-2024-49829 | Medium | 6.7 | 2025-05-06 | Memory corruption can occur during context user dumps due to inadequate checks on buffer length. |
CVE-2024-45583 | Medium | 6.6 | 2025-05-06 | Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations. |
CVE-2024-45581 | Medium | 6.6 | 2025-05-06 | Memory corruption while sound model registration for voice activation with audio kernel driver. |
CVE-2024-45579 | High | 7.8 | 2025-05-06 | Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requireme… |
CVE-2024-45578 | High | 7.8 | 2025-05-06 | Memory corruption while acquire and update IOCTLs during IFE output resource ID validation. |
CVE-2024-45577 | High | 7.8 | 2025-05-06 | Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information. |
CVE-2024-45576 | High | 7.8 | 2025-05-06 | Memory corruption while prociesing command buffer buffer in OPE module. |
CVE-2024-45575 | High | 7.8 | 2025-05-06 | Memory corruption Camera kernel when large number of devices are attached through userspace. |
CVE-2024-45574 | High | 7.8 | 2025-05-06 | Memory corruption during array access in Camera kernel due to invalid index from invalid command data. |
CVE-2024-45570 | Medium | 6.6 | 2025-05-06 | Memory corruption may occur during IO configuration processing when the IO port count is invalid. |
CVE-2024-45568 | Medium | 6.7 | 2025-05-06 | Memory corruption due to improper bounds check while command handling in camera-kernel driver. |
CVE-2024-45567 | High | 7.8 | 2025-05-06 | Memory corruption while encoding JPEG format. |
CVE-2024-45566 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent buffer access due to modification of the reference count. |