2024 CVEs (page 14)
Page 14 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11617 | Critical | 9.8 | 2025-05-09 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fo… |
CVE-2024-9448 | High | 7.5 | 2025-05-08 | On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rule… |
CVE-2024-8100 | High | 8.7 | 2025-05-08 | On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision. |
CVE-2024-12378 | Critical | 9.1 | 2025-05-08 | On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan t… |
CVE-2024-11186 | Critical | 10.0 | 2025-05-08 | On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS dev… |
CVE-2024-13009 | High | 7.2 | 2025-05-08 | In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result… |
CVE-2024-6648 | High | 7.5 | 2025-05-08 | Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' w… |
CVE-2024-13793 | High | 7.3 | 2025-05-08 | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin… |
CVE-2024-55651 | Medium | 5.4 | 2025-05-08 | i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading… |
CVE-2024-47619 | High | 7.5 | 2025-05-07 | syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It… |
CVE-2024-12120 | Medium | 5.4 | 2025-05-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parame… |
CVE-2024-12225 | Critical | 9.1 | 2025-05-06 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and… |
CVE-2024-49847 | High | 7.5 | 2025-05-06 | Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE. |
CVE-2024-49846 | High | 8.2 | 2025-05-06 | Memory corruption while decoding of OTA messages from T3448 IE. |
CVE-2024-49845 | High | 7.8 | 2025-05-06 | Memory corruption during the FRS UDS generation process. |
CVE-2024-49844 | High | 7.8 | 2025-05-06 | Memory corruption while triggering commands in the PlayReady Trusted application. |
CVE-2024-49842 | High | 7.8 | 2025-05-06 | Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions. |
CVE-2024-49841 | High | 7.8 | 2025-05-06 | Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling. |
CVE-2024-49835 | High | 7.8 | 2025-05-06 | Memory corruption while reading secure file. |
CVE-2024-49830 | Medium | 6.6 | 2025-05-06 | Memory corruption while processing an IOCTL call to set mixer controls. |
CVE-2024-49829 | Medium | 6.7 | 2025-05-06 | Memory corruption can occur during context user dumps due to inadequate checks on buffer length. |
CVE-2024-45583 | Medium | 6.6 | 2025-05-06 | Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations. |
CVE-2024-45581 | Medium | 6.6 | 2025-05-06 | Memory corruption while sound model registration for voice activation with audio kernel driver. |
CVE-2024-45579 | High | 7.8 | 2025-05-06 | Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requireme… |
CVE-2024-45578 | High | 7.8 | 2025-05-06 | Memory corruption while acquire and update IOCTLs during IFE output resource ID validation. |
CVE-2024-45577 | High | 7.8 | 2025-05-06 | Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information. |
CVE-2024-45576 | High | 7.8 | 2025-05-06 | Memory corruption while prociesing command buffer buffer in OPE module. |
CVE-2024-45575 | High | 7.8 | 2025-05-06 | Memory corruption Camera kernel when large number of devices are attached through userspace. |
CVE-2024-45574 | High | 7.8 | 2025-05-06 | Memory corruption during array access in Camera kernel due to invalid index from invalid command data. |
CVE-2024-45570 | Medium | 6.6 | 2025-05-06 | Memory corruption may occur during IO configuration processing when the IO port count is invalid. |
CVE-2024-45568 | Medium | 6.7 | 2025-05-06 | Memory corruption due to improper bounds check while command handling in camera-kernel driver. |
CVE-2024-45567 | High | 7.8 | 2025-05-06 | Memory corruption while encoding JPEG format. |
CVE-2024-45566 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent buffer access due to modification of the reference count. |
CVE-2024-45565 | High | 7.8 | 2025-05-06 | Memory corruption when blob structure is modified by user-space after kernel verification. |
CVE-2024-45564 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent access to server info object due to incorrect reference count update. |
CVE-2024-45563 | Medium | 6.6 | 2025-05-06 | Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session. |
CVE-2024-45562 | Medium | 6.6 | 2025-05-06 | Memory corruption during concurrent access to server info object due to unprotected critical field. |
CVE-2024-45554 | High | 7.8 | 2025-05-06 | Memory corruption during concurrent SSR execution due to race condition on the global maps list. |
CVE-2024-58252 | Medium | 6.2 | 2025-05-06 | Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confi… |
CVE-2024-39442 | Medium | 6.2 | 2025-05-06 | In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2024-42213 | Medium | 5.3 | 2025-05-05 | HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing… |
CVE-2024-42212 | Medium | 5.4 | 2025-05-05 | HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious… |
CVE-2024-57235 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57234 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi… |
CVE-2024-57233 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57232 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f… |
CVE-2024-57231 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu… |
CVE-2024-57230 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu… |
CVE-2024-57229 | Critical | 9.8 | 2025-05-05 | NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-51991 | Medium | 4.9 | 2025-05-05 | October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that… |
CVE-2024-11615 | Medium | 5.3 | 2025-05-05 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' a… |
CVE-2024-58237 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execu… |
CVE-2024-58100 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: check changes_pkt_data property for extension programs When processing calls to glob… |
CVE-2024-58098 | High | 7.8 | 2025-05-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: track changes_pkt_data property for global functions When processing calls to certai… |
CVE-2024-58134 | High | 8.1 | 2025-05-03 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These pred… |
CVE-2024-41753 | Medium | 6.1 | 2025-05-03 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability all… |
CVE-2024-58135 | Medium | 5.3 | 2025-05-03 | Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a defaul… |
CVE-2024-13738 | High | 7.3 | 2025-05-03 | The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-55069 | Medium | 5.3 | 2025-05-02 | ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. |
CVE-2024-58253 | Low | 2.9 | 2025-05-02 | In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an i… |
CVE-2024-11142 | High | 8.8 | 2025-05-02 | Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Co… |
CVE-2024-13860 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and includi… |
CVE-2024-13859 | Medium | 6.4 | 2025-05-02 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, a… |
CVE-2024-13858 | Medium | 6.4 | 2025-05-02 | The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions u… |
CVE-2024-13420 | Medium | 4.3 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_se… |
CVE-2024-13419 | Medium | 6.4 | 2025-05-02 | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveO… |
CVE-2024-13418 | High | 8.8 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in va… |
CVE-2024-13344 | High | 7.5 | 2025-05-02 | The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to… |
CVE-2024-13322 | High | 7.5 | 2025-05-02 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions u… |
CVE-2024-12023 | Medium | 6.5 | 2025-05-02 | The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping… |
CVE-2024-55913 | Medium | 5.3 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2024-55912 | Medium | 5.9 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2024-55910 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2024-55909 | Medium | 6.5 | 2025-05-02 | IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlli… |
CVE-2024-52903 | Medium | 5.3 | 2025-05-01 | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially cr… |
CVE-2024-48907 | High | 7.5 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. |
CVE-2024-48906 | Medium | 6.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. |
CVE-2024-48905 | Critical | 9.1 | 2025-05-01 | Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. |
CVE-2024-52979 | Medium | 6.5 | 2025-05-01 | Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service… |
CVE-2024-52976 | Medium | 4.4 | 2025-05-01 | Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via paramet… |
CVE-2024-11994 | Medium | 5.7 | 2025-05-01 | APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclo… |
CVE-2024-11390 | Medium | 5.4 | 2025-05-01 | Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScr… |
CVE-2024-13381 | Medium | 4.8 | 2025-05-01 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-13845 | Medium | 5.5 | 2025-05-01 | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed'… |
CVE-2024-30146 | Medium | 4.1 | 2025-04-30 | Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-30145 | Medium | 6.5 | 2025-04-30 | Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30115 | Medium | 6.3 | 2025-04-30 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2024-6032 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affect… |
CVE-2024-6031 | High | 7.8 | 2025-04-30 | Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on… |
CVE-2024-6030 | High | 7.0 | 2025-04-30 | Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Mode… |
CVE-2024-6029 | Medium | 5.0 | 2025-04-30 | Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris… |
CVE-2024-13943 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape th… |
CVE-2024-9877 | Medium | 4.3 | 2025-04-30 | : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: throug… |
CVE-2024-9876 | High | 7.3 | 2025-04-30 | : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4… |
CVE-2024-47784 | Low | 2.6 | 2025-04-30 | Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI Th… |
CVE-2024-57698 | High | 7.5 | 2025-04-29 | An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial… |
CVE-2024-58099 | High | 8.6 | 2025-04-29 | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported conn… |
CVE-2024-12273 | Low | 3.5 | 2025-04-29 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-11922 | Medium | 6.3 | 2025-04-28 | Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emai… |
CVE-2024-10635 | Medium | 6.1 | 2025-04-28 | Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attach… |