2024 CVEs (page 13)
Page 13 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11189 | Medium | 4.8 | 2025-05-15 | The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-11141 | Medium | 6.1 | 2025-05-15 | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscr… |
CVE-2024-11140 | Low | 3.5 | 2025-05-15 | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2024-11109 | Medium | 4.8 | 2025-05-15 | The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10818 | Medium | 5.4 | 2025-05-15 | The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-10677 | Medium | 4.3 | 2025-05-15 | The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin cha… |
CVE-2024-10639 | Medium | 4.8 | 2025-05-15 | The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-10634 | Medium | 4.3 | 2025-05-15 | The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-10632 | Medium | 4.8 | 2025-05-15 | The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to… |
CVE-2024-10631 | Medium | 6.5 | 2025-05-15 | The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them bac… |
CVE-2024-10504 | Medium | 5.4 | 2025-05-15 | The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the pag… |
CVE-2024-10475 | Medium | 4.8 | 2025-05-15 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-10362 | Medium | 4.8 | 2025-05-15 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-p… |
CVE-2024-10149 | Medium | 4.8 | 2025-05-15 | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10145 | Medium | 4.8 | 2025-05-15 | The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10144 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-10143 | Medium | 4.8 | 2025-05-15 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10107 | Medium | 4.8 | 2025-05-15 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10098 | Low | 2.7 | 2025-05-15 | The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them an… |
CVE-2024-10076 | Medium | 5.9 | 2025-05-15 | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs… |
CVE-2024-10075 | Medium | 5.6 | 2025-05-15 | The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow u… |
CVE-2024-10054 | Medium | 4.8 | 2025-05-15 | The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-10009 | Medium | 4.1 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2024-0970 | Medium | 5.3 | 2025-05-15 | This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to man… |
CVE-2024-0852 | High | 8.8 | 2025-05-15 | The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing… |
CVE-2024-0249 | High | 7.1 | 2025-05-15 | The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect… |
CVE-2024-56006 | Medium | 5.3 | 2025-05-15 | Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1. |
CVE-2024-51666 | Medium | 4.3 | 2025-05-15 | Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0. |
CVE-2024-52880 | High | 7.9 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52879 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52878 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52877 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-13914 | High | 7.2 | 2025-05-15 | The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanc… |
CVE-2024-45067 | High | 8.2 | 2025-05-14 | Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalatio… |
CVE-2024-56427 | Medium | 6.5 | 2025-05-14 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W9… |
CVE-2024-55569 | High | 7.5 | 2025-05-14 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110… |
CVE-2024-58101 | High | 8.1 | 2025-05-14 | Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio p… |
CVE-2024-57096 | Medium | 5.5 | 2025-05-14 | An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. |
CVE-2024-45516 | Medium | 6.1 | 2025-05-14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-S… |
CVE-2024-56157 | Medium | 6.3 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack c… |
CVE-2024-52601 | Medium | 6.5 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access t… |
CVE-2024-10865 | | 2025-05-14 | Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication ve… | |
CVE-2024-10864 | | 2025-05-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication. This issue affects Adva… | |
CVE-2024-57273 | Medium | 5.4 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backu… |
CVE-2024-54780 | High | 8.8 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper saniti… |
CVE-2024-54779 | Medium | 5.4 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. |
CVE-2024-24780 | Critical | 9.8 | 2025-05-14 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function fro… |
CVE-2024-8988 | Medium | 5.3 | 2025-05-14 | The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file… |
CVE-2024-13940 | Medium | 5.5 | 2025-05-14 | The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook fun… |
CVE-2024-52290 | Medium | 6.3 | 2025-05-14 | LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate th… |
CVE-2024-48869 | Medium | 6.1 | 2025-05-13 | Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions… |
CVE-2024-47800 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local acc… |
CVE-2024-47795 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potentially enable esc… |
CVE-2024-47550 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-46895 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an authenticated user t… |
CVE-2024-45371 | Medium | 6.7 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated user to potentially e… |
CVE-2024-45333 | High | 7.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to potent… |
CVE-2024-45332 | Medium | 5.6 | 2025-05-13 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for… |
CVE-2024-43420 | Medium | 5.6 | 2025-05-13 | Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Atom(R) processors may… |
CVE-2024-43101 | Medium | 5.3 | 2025-05-13 | Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an authenticated user… |
CVE-2024-39833 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-39758 | Medium | 5.9 | 2025-05-13 | Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 31.0.101.4032 may allow an authenticated user to potentially e… |
CVE-2024-36292 | High | 7.3 | 2025-05-13 | Improper buffer restrictions for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authenticated user to p… |
CVE-2024-31150 | Low | 3.8 | 2025-05-13 | Out-of-bounds read for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2024-31073 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-29222 | Medium | 6.1 | 2025-05-13 | Out-of-bounds write for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-28956 | Medium | 5.6 | 2025-05-13 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated us… |
CVE-2024-28954 | Medium | 6.7 | 2025-05-13 | Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2024-28036 | Medium | 5.6 | 2025-05-13 | Improper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-6364 | Medium | 6.4 | 2025-05-13 | A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to th… |
CVE-2024-36339 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary c… |
CVE-2024-36321 | High | 7.3 | 2025-05-13 | Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution. |
CVE-2024-21960 | High | 7.3 | 2025-05-13 | Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege escalation potenti… |
CVE-2024-56526 | Medium | 4.9 | 2025-05-13 | An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error. |
CVE-2024-48766 | High | 8.6 | 2025-05-13 | NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos an… |
CVE-2024-46506 | Critical | 10.0 | 2025-05-13 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authenticat… |
CVE-2024-35281 | Low | 2.5 | 2025-05-13 | An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and… |
CVE-2024-12533 | Low | 3.3 | 2025-05-13 | Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This issue affects SecureC… |
CVE-2024-42446 | High | 7.5 | 2025-05-13 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-36340 | Medium | 6.6 | 2025-05-13 | A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file d… |
CVE-2024-51447 | Medium | 5.3 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected applica… |
CVE-2024-51446 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected applicat… |
CVE-2024-51445 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External… |
CVE-2024-51444 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user in… |
CVE-2024-23815 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highl… |
CVE-2024-55466 | Medium | 6.5 | 2025-05-12 | An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to… |
CVE-2024-4982 | High | 7.6 | 2025-05-12 | A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secret… |
CVE-2024-4981 | High | 7.6 | 2025-05-12 | A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show… |
CVE-2024-56524 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request. |
CVE-2024-56523 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request bo… |
CVE-2024-8973 | Medium | 6.5 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2024-9524 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in System Speedup Service in Avira Operations GmbH Avira Prime Version 1.1.96.2 on Windows 10 x64 allow… |
CVE-2024-13962 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 a… |
CVE-2024-13961 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attac… |
CVE-2024-13960 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to esca… |
CVE-2024-13959 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges… |
CVE-2024-13944 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows… |
CVE-2024-13759 | High | 7.8 | 2025-05-09 | Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via… |
CVE-2024-12442 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. |
CVE-2024-11861 | Critical | 9.8 | 2025-05-09 | EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access. |