2024 CVEs (page 15)
Page 15 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13569 | High | 7.1 | 2025-04-22 | The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-46899 | High | 7.1 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue aff… |
CVE-2024-58250 | Critical | 9.3 | 2025-04-22 | The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. |
CVE-2024-57394 | High | 8.8 | 2025-04-21 | The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file p… |
CVE-2024-12543 | | 2025-04-21 | User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authentica… | |
CVE-2024-42699 | Medium | 6.5 | 2025-04-21 | Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image titl… |
CVE-2024-12863 | | 2025-04-21 | Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the syst… | |
CVE-2024-12862 | | 2025-04-21 | Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exte… | |
CVE-2024-41446 | Medium | 5.4 | 2025-04-21 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2024-13926 | High | 7.5 | 2025-04-19 | The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exp… |
CVE-2024-53591 | Critical | 9.8 | 2025-04-18 | An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack. |
CVE-2024-57493 | Medium | 5.5 | 2025-04-18 | An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the setsockopt function. |
CVE-2024-41447 | Medium | 5.4 | 2025-04-18 | A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inje… |
CVE-2024-29643 | Critical | 9.1 | 2025-04-18 | An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. |
CVE-2024-46089 | Medium | 6.3 | 2025-04-18 | 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin. |
CVE-2024-49808 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper author… |
CVE-2024-45651 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user… |
CVE-2024-13650 | Medium | 6.4 | 2025-04-18 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget i… |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2024-55211 | High | 8.4 | 2025-04-17 | An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. |
CVE-2024-53924 | Critical | 9.8 | 2025-04-17 | Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=… |
CVE-2024-40124 | Medium | 5.4 | 2025-04-17 | Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature. |
CVE-2024-56518 | Critical | 9.8 | 2025-04-17 | Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client c… |
CVE-2024-55238 | High | 7.1 | 2025-04-17 | OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface… |
CVE-2024-12530 | | 2025-04-17 | Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager… | |
CVE-2024-13925 | High | 7.5 | 2025-04-17 | The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the lo… |
CVE-2024-11924 | Low | 3.5 | 2025-04-17 | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow hi… |
CVE-2024-55372 | Critical | 9.8 | 2025-04-16 | Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP fil… |
CVE-2024-55371 | Critical | 9.8 | 2025-04-16 | Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. T… |
CVE-2024-53305 | High | 7.3 | 2025-04-16 | An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query. |
CVE-2024-53304 | Medium | 6.5 | 2025-04-16 | An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing a… |
CVE-2024-53303 | High | 8.8 | 2025-04-16 | A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute… |
CVE-2024-40074 | Medium | 4.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSettings.php?f=update_… |
CVE-2024-40073 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=ge… |
CVE-2024-40072 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate… |
CVE-2024-40071 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=up… |
CVE-2024-40070 | Medium | 5.1 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This… |
CVE-2024-40069 | Medium | 5.4 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/Users.php?f=save, and the po… |
CVE-2024-40068 | Medium | 5.9 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=template… |
CVE-2024-22314 | Medium | 5.9 | 2025-04-16 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highl… |
CVE-2024-58249 | Low | 3.7 | 2025-04-16 | In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. |
CVE-2024-56736 | Medium | 6.5 | 2025-04-16 | Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended t… |
CVE-2024-58097 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix RCU stall while reaping monitor destination ring While processing the m… |
CVE-2024-58096 | High | 8.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode ath11k_hal_srng_* shou… |
CVE-2024-58095 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before txBeginAnon() call Added a read-only check before calling… |
CVE-2024-58094 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before truncation in jfs_truncate_nolock() Added a check for "re… |
CVE-2024-58093 | High | 7.8 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f… |
CVE-2024-58248 | Low | 3.5 | 2025-04-16 | nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards. |
CVE-2024-58092 | Medium | 5.5 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops-… |
CVE-2024-52281 | High | 8.9 | 2025-04-16 | A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through th… |
CVE-2024-22036 | Critical | 9.1 | 2025-04-16 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher co… |
CVE-2024-10680 | Medium | 4.8 | 2025-04-16 | The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13452 | Medium | 6.1 | 2025-04-16 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to mis… |
CVE-2024-49200 | Medium | 6.4 | 2025-04-15 | An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has… |
CVE-2024-44843 | Medium | 5.9 | 2025-04-15 | An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OC… |
CVE-2024-42193 | High | 8.1 | 2025-04-15 | HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario presents a possibi… |
CVE-2024-50960 | High | 7.2 | 2025-04-15 | A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= 2.16, and SME 211 <… |
CVE-2024-42200 | Medium | 5.4 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input. |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |
CVE-2024-36842 | High | 7.3 | 2025-04-15 | An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Number PlatformVER:K24-2… |
CVE-2024-13177 | | 2025-04-15 | Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A st… | |
CVE-2024-11084 | | 2025-04-15 | Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. | |
CVE-2024-45712 | Low | 2.6 | 2025-04-15 | SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account… |
CVE-2024-13610 | Medium | 4.8 | 2025-04-15 | The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-13207 | Medium | 4.8 | 2025-04-15 | The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-49825 | Medium | 6.3 | 2025-04-14 | IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session aft… |
CVE-2024-49709 | Medium | 4.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser mig… |
CVE-2024-49708 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into fillin… |
CVE-2024-49707 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-49706 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent i… |
CVE-2024-49705 | Medium | 6.5 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into usin… |
CVE-2024-13598 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. Using a functionality of creating new… |
CVE-2024-13597 | | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… | |
CVE-2024-10090 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-10089 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into fillin… |
CVE-2024-10088 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-10087 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containi… |
CVE-2024-9230 | Medium | 5.9 | 2025-04-14 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which coul… |
CVE-2024-56406 | High | 8.4 | 2025-04-13 | A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.3… |
CVE-2024-13338 | Medium | 5.3 | 2025-04-12 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… |
CVE-2024-13337 | Medium | 4.3 | 2025-04-12 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… |
CVE-2024-11679 | Medium | 4.4 | 2025-04-11 | An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privi… |
CVE-2024-13861 | High | 7.8 | 2025-04-11 | A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code ex… |
CVE-2024-52280 | High | 7.7 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to acces… |
CVE-2024-52282 | Medium | 6.2 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Cata… |
CVE-2024-51461 | Medium | 4.3 | 2025-04-11 | IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume… |
CVE-2024-11129 | Medium | 6.3 | 2025-04-10 | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers… |
CVE-2024-38865 | High | 8.8 | 2025-04-10 | Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allow… |
CVE-2024-13909 | Medium | 4.9 | 2025-04-10 | The Accredible Certificates & Open Badges plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and… |
CVE-2024-13896 | Medium | 6.5 | 2025-04-10 | The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression… |
CVE-2024-13874 | High | 7.1 | 2025-04-10 | The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-10894 | Medium | 6.4 | 2025-04-10 | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and… |
CVE-2024-58136 | Critical | 9.0 | 2025-04-10 | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in Febru… |
CVE-2024-55210 | Critical | 9.8 | 2025-04-09 | An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message. |
CVE-2024-8243 | Medium | 6.3 | 2025-04-09 | The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escap… |
CVE-2024-6860 | Medium | 4.3 | 2025-04-09 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make… |
CVE-2024-6857 | Medium | 4.3 | 2025-04-09 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow atta… |
CVE-2024-55354 | High | 8.8 | 2025-04-08 | Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let a… |
CVE-2024-12556 | High | 8.7 | 2025-04-08 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. |