2024 CVEs (page 14)
Page 14 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45565 | High | 7.8 | 2025-05-06 | Memory corruption when blob structure is modified by user-space after kernel verification. |
CVE-2024-45564 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent access to server info object due to incorrect reference count update. |
CVE-2024-45563 | Medium | 6.6 | 2025-05-06 | Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session. |
CVE-2024-45562 | Medium | 6.6 | 2025-05-06 | Memory corruption during concurrent access to server info object due to unprotected critical field. |
CVE-2024-45554 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent SSR execution due to race condition on the global maps list. |
CVE-2024-58252 | Medium | 6.2 | 2025-05-06 | Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confi… |
CVE-2024-39442 | Medium | 6.2 | 2025-05-06 | In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2024-42213 | Medium | 5.3 | 2025-05-05 | HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing… |
CVE-2024-42212 | Medium | 5.4 | 2025-05-05 | HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious… |
CVE-2024-57235 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57234 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi… |
CVE-2024-57233 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57232 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f… |
CVE-2024-57231 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu… |
CVE-2024-57230 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu… |
CVE-2024-57229 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-51991 | Medium | 4.9 | 2025-05-05 | October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that… |
CVE-2024-11615 | Medium | 5.3 | 2025-05-05 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' a… |
CVE-2024-58237 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execu… |
CVE-2024-58100 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: check changes_pkt_data property for extension programs When processing calls to glob… |
CVE-2024-58098 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: track changes_pkt_data property for global functions When processing calls to certai… |
CVE-2024-58134 | High | 8.1 | 2025-05-03 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These pred… |
CVE-2024-41753 | Medium | 6.1 | 2025-05-03 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability all… |
CVE-2024-58135 | Medium | 5.3 | 2025-05-03 | Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a defaul… |
CVE-2024-13738 | High | 7.3 | 2025-05-03 | The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-55069 | Medium | 5.3 | 2025-05-02 | ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. |
CVE-2024-58253 | Low | 2.9 | 2025-05-02 | In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an i… |
CVE-2024-11142 | High | 8.8 | 2025-05-02 | Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Co… |
CVE-2024-13860 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and includi… |
CVE-2024-13859 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, a… |
CVE-2024-13858 | Medium | 6.4 | 2025-05-02 | The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions u… |
CVE-2024-13420 | Medium | 4.3 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_se… |
CVE-2024-13419 | Medium | 6.4 | 2025-05-02 | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveO… |
CVE-2024-13418 | High | 8.8 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in va… |
CVE-2024-13344 | High | 7.5 | 2025-05-02 | The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to… |
CVE-2024-13322 | High | 7.5 | 2025-05-02 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions u… |
CVE-2024-12023 | Medium | 6.5 | 2025-05-02 | The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping… |
CVE-2024-55913 | Medium | 5.3 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2024-55912 | Medium | 5.9 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2024-55910 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2024-55909 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlli… |
CVE-2024-52903 | Medium | 5.3 | 2025-05-01 | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially cr… |
CVE-2024-48907 | High | 7.5 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. |
CVE-2024-48906 | Medium | 6.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. |
CVE-2024-48905 | Critical | 9.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. |
CVE-2024-52979 | Medium | 6.5 | 2025-05-01 | Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service… |
CVE-2024-52976 | Medium | 4.4 | 2025-05-01 | Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via paramet… |
CVE-2024-11994 | Medium | 5.7 | 2025-05-01 | APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclo… |
CVE-2024-11390 | Medium | 5.4 | 2025-05-01 | Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScr… |
CVE-2024-13381 | Medium | 4.8 | 2025-05-01 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-13845 | Medium | 5.5 | 2025-05-01 | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed'… |
CVE-2024-30146 | Medium | 4.1 | 2025-04-30 | Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-30145 | Medium | 6.5 | 2025-04-30 | Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30115 | Medium | 6.3 | 2025-04-30 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2024-6032 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affect… |
CVE-2024-6031 | High | 7.8 | 2025-04-30 | Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on… |
CVE-2024-6030 | High | 7.0 | 2025-04-30 | Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Mode… |
CVE-2024-6029 | Medium | 5.0 | 2025-04-30 | Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris… |
CVE-2024-13943 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape th… |
CVE-2024-9877 | Medium | 4.3 | 2025-04-30 | : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: throug… |
CVE-2024-9876 | High | 7.3 | 2025-04-30 | : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4… |
CVE-2024-47784 | Low | 2.6 | 2025-04-30 | Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI Th… |
CVE-2024-57698 | High | 7.5 | 2025-04-29 | An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial… |
CVE-2024-58099 | High | 8.6 | 2025-04-29 | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported conn… |
CVE-2024-12273 | Low | 3.5 | 2025-04-29 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-11922 | Medium | 6.3 | 2025-04-28 | Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emai… |
CVE-2024-10635 | Medium | 6.1 | 2025-04-28 | Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attach… |
CVE-2024-12706 | | 2025-04-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability c… | |
CVE-2024-32499 | Medium | 4.9 | 2025-04-28 | Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. |
CVE-2024-9771 | Low | 3.5 | 2025-04-28 | The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-13688 | Medium | 5.3 | 2025-04-28 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass… |
CVE-2024-52888 | Medium | 5.4 | 2025-04-27 | For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties. |
CVE-2024-52887 | Low | 3.5 | 2025-04-27 | Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. |
CVE-2024-53636 | Medium | 6.4 | 2025-04-26 | An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbit… |
CVE-2024-13812 | Medium | 6.5 | 2025-04-26 | The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the s… |
CVE-2024-13808 | High | 8.8 | 2025-04-26 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widg… |
CVE-2024-30152 | Medium | 6.5 | 2025-04-25 | HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify dat… |
CVE-2024-56156 | Critical | 9.0 | 2025-04-25 | Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This… |
CVE-2024-57375 | Low | 2.4 | 2025-04-25 | Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application c… |
CVE-2024-6199 | | 2025-04-25 | An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulat… | |
CVE-2024-6198 | | 2025-04-25 | The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is af… | |
CVE-2024-11917 | High | 8.1 | 2025-04-25 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper con… |
CVE-2024-30127 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2024-30147 | Medium | 6.5 | 2025-04-24 | Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30114 | Low | 3.7 | 2025-04-24 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. |
CVE-2024-30113 | Medium | 6.3 | 2025-04-24 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-13307 | Medium | 5.3 | 2025-04-24 | The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check o… |
CVE-2024-12244 | Medium | 4.3 | 2025-04-24 | An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in Git… |
CVE-2024-22351 | Medium | 6.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2024-58251 | Low | 2.5 | 2025-04-23 | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a d… |
CVE-2024-47829 | Medium | 6.5 | 2025-04-23 | pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a coll… |
CVE-2024-10306 | Medium | 5.4 | 2025-04-23 | A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does n… |
CVE-2024-53569 | Medium | 5.4 | 2025-04-22 | A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers… |
CVE-2024-53568 | Medium | 5.4 | 2025-04-22 | A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to e… |
CVE-2024-33452 | High | 7.7 | 2025-04-22 | An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. |
CVE-2024-46546 | High | 7.3 | 2025-04-22 | NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerability allows attack… |
CVE-2024-40446 | Critical | 9.8 | 2025-04-22 | An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script |
CVE-2024-40445 | High | 7.3 | 2025-04-22 | A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulati… |
CVE-2024-11299 | Medium | 5.3 | 2025-04-22 | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core searc… |