2024 CVEs (page 15)
Page 15 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12706 | | 2025-04-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability c… | |
CVE-2024-32499 | Medium | 4.9 | 2025-04-28 | Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. |
CVE-2024-9771 | Low | 3.5 | 2025-04-28 | The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-13688 | Medium | 5.3 | 2025-04-28 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass… |
CVE-2024-52888 | Medium | 5.4 | 2025-04-27 | For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties. |
CVE-2024-52887 | Low | 3.5 | 2025-04-27 | Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. |
CVE-2024-53636 | Medium | 6.4 | 2025-04-26 | An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbit… |
CVE-2024-13812 | Medium | 6.5 | 2025-04-26 | The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the s… |
CVE-2024-13808 | High | 8.8 | 2025-04-26 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widg… |
CVE-2024-30152 | Medium | 6.5 | 2025-04-25 | HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify dat… |
CVE-2024-56156 | Critical | 9.0 | 2025-04-25 | Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This… |
CVE-2024-57375 | Low | 2.4 | 2025-04-25 | Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application c… |
CVE-2024-6199 | | 2025-04-25 | An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulat… | |
CVE-2024-6198 | | 2025-04-25 | The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. This interface is af… | |
CVE-2024-11917 | High | 8.1 | 2025-04-25 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper con… |
CVE-2024-30127 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2024-30147 | Medium | 6.5 | 2025-04-24 | Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications. |
CVE-2024-30114 | Low | 3.7 | 2025-04-24 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. |
CVE-2024-30113 | Medium | 6.3 | 2025-04-24 | Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget. |
CVE-2024-30148 | Medium | 4.1 | 2025-04-24 | Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem. |
CVE-2024-13307 | Medium | 5.3 | 2025-04-24 | The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check o… |
CVE-2024-12244 | Medium | 4.3 | 2025-04-24 | An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in Git… |
CVE-2024-22351 | Medium | 6.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2024-58251 | Low | 2.5 | 2025-04-23 | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a d… |
CVE-2024-47829 | Medium | 6.5 | 2025-04-23 | pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a coll… |
CVE-2024-10306 | Medium | 5.4 | 2025-04-23 | A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does n… |
CVE-2024-53569 | Medium | 5.4 | 2025-04-22 | A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers… |
CVE-2024-53568 | Medium | 5.4 | 2025-04-22 | A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to e… |
CVE-2024-33452 | High | 7.7 | 2025-04-22 | An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. |
CVE-2024-46546 | High | 7.3 | 2025-04-22 | NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerability allows attack… |
CVE-2024-40446 | Critical | 9.8 | 2025-04-22 | An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script |
CVE-2024-40445 | High | 7.3 | 2025-04-22 | A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulati… |
CVE-2024-11299 | Medium | 5.3 | 2025-04-22 | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core searc… |
CVE-2024-13569 | High | 7.1 | 2025-04-22 | The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-46899 | High | 7.1 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue aff… |
CVE-2024-58250 | Critical | 9.3 | 2025-04-22 | The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. |
CVE-2024-57394 | High | 8.8 | 2025-04-21 | The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file p… |
CVE-2024-12543 | | 2025-04-21 | User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authentica… | |
CVE-2024-42699 | Medium | 6.5 | 2025-04-21 | Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image titl… |
CVE-2024-12863 | | 2025-04-21 | Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the syst… | |
CVE-2024-12862 | | 2025-04-21 | Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exte… | |
CVE-2024-41446 | Medium | 5.4 | 2025-04-21 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2024-13926 | High | 7.5 | 2025-04-19 | The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exp… |
CVE-2024-53591 | Critical | 9.8 | 2025-04-18 | An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack. |
CVE-2024-57493 | Medium | 5.5 | 2025-04-18 | An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the setsockopt function. |
CVE-2024-41447 | Medium | 5.4 | 2025-04-18 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2024-29643 | Critical | 9.1 | 2025-04-18 | An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. |
CVE-2024-46089 | Medium | 6.3 | 2025-04-18 | 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin. |
CVE-2024-49808 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper author… |
CVE-2024-45651 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user… |
CVE-2024-13650 | Medium | 6.4 | 2025-04-18 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget i… |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2024-55211 | High | 8.4 | 2025-04-17 | An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. |
CVE-2024-53924 | Critical | 9.8 | 2025-04-17 | Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=… |
CVE-2024-40124 | Medium | 5.4 | 2025-04-17 | Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature. |
CVE-2024-56518 | Critical | 9.8 | 2025-04-17 | Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client c… |
CVE-2024-55238 | High | 7.1 | 2025-04-17 | OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface… |
CVE-2024-12530 | | 2025-04-17 | Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager… | |
CVE-2024-13925 | High | 7.5 | 2025-04-17 | The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the lo… |
CVE-2024-11924 | Low | 3.5 | 2025-04-17 | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow hi… |
CVE-2024-55372 | Critical | 9.8 | 2025-04-16 | Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fil… |
CVE-2024-55371 | Critical | 9.8 | 2025-04-16 | Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. T… |
CVE-2024-53305 | High | 7.3 | 2025-04-16 | An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query. |
CVE-2024-53304 | Medium | 6.5 | 2025-04-16 | An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing a… |
CVE-2024-53303 | High | 8.8 | 2025-04-16 | A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute… |
CVE-2024-40074 | Medium | 4.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSettings.php?f=update_… |
CVE-2024-40073 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=ge… |
CVE-2024-40072 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate… |
CVE-2024-40071 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=up… |
CVE-2024-40070 | Medium | 5.1 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This… |
CVE-2024-40069 | Medium | 5.4 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/Users.php?f=save, and the po… |
CVE-2024-40068 | Medium | 5.9 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=template… |
CVE-2024-22314 | Medium | 5.9 | 2025-04-16 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highl… |
CVE-2024-58249 | Low | 3.7 | 2025-04-16 | In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. |
CVE-2024-56736 | Medium | 6.5 | 2025-04-16 | Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended t… |
CVE-2024-58097 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix RCU stall while reaping monitor destination ring While processing the m… |
CVE-2024-58096 | High | 8.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode ath11k_hal_srng_* shou… |
CVE-2024-58095 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before txBeginAnon() call Added a read-only check before calling… |
CVE-2024-58094 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before truncation in jfs_truncate_nolock() Added a check for "re… |
CVE-2024-58093 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f… |
CVE-2024-58248 | Low | 3.5 | 2025-04-16 | nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards. |
CVE-2024-58092 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops-… |
CVE-2024-52281 | High | 8.9 | 2025-04-16 | A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through th… |
CVE-2024-22036 | Critical | 9.1 | 2025-04-16 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher co… |
CVE-2024-10680 | Medium | 4.8 | 2025-04-16 | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13452 | Medium | 6.1 | 2025-04-16 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to mis… |
CVE-2024-49200 | Medium | 6.4 | 2025-04-15 | An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has… |
CVE-2024-44843 | Medium | 5.9 | 2025-04-15 | An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OC… |
CVE-2024-42193 | High | 8.1 | 2025-04-15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibi… |
CVE-2024-50960 | High | 7.2 | 2025-04-15 | A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= 2.16, and SME 211 <… |
CVE-2024-42200 | Medium | 5.4 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input. |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |
CVE-2024-36842 | High | 7.3 | 2025-04-15 | An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Number PlatformVER:K24-2… |
CVE-2024-13177 | | 2025-04-15 | Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A st… | |
CVE-2024-11084 | | 2025-04-15 | Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. | |
CVE-2024-45712 | Low | 2.6 | 2025-04-15 | SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account… |
CVE-2024-13610 | Medium | 4.8 | 2025-04-15 | The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-13207 | Medium | 4.8 | 2025-04-15 | The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-49825 | Medium | 6.3 | 2025-04-14 | IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session aft… |