2024 CVEs (page 153)
Page 153 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45330 | High | 7.2 | 2024-10-08 | A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privil… |
CVE-2024-33506 | Low | 3.3 | 2024-10-08 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows… |
CVE-2024-8482 | Medium | 6.4 | 2024-10-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and i… |
CVE-2024-8431 | Medium | 4.3 | 2024-10-08 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-9207 | Medium | 6.1 | 2024-10-08 | The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the… |
CVE-2024-9005 | | 2024-10-08 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is… | |
CVE-2024-8884 | Critical | 9.8 | 2024-10-08 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attacker has access to a… |
CVE-2024-8488 | Medium | 4.4 | 2024-10-08 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insuffi… |
CVE-2024-8629 | Medium | 6.1 | 2024-10-08 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wit… |
CVE-2024-8518 | Low | 3.3 | 2024-10-08 | CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted project file is loaded… |
CVE-2024-8433 | Medium | 6.4 | 2024-10-08 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' par… |
CVE-2024-8422 | High | 7.8 | 2024-10-08 | CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when applicat… |
CVE-2024-3506 | Medium | 6.7 | 2024-10-08 | A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on… |
CVE-2024-8943 | Critical | 9.8 | 2024-10-08 | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification o… |
CVE-2024-8911 | Critical | 9.8 | 2024-10-08 | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to i… |
CVE-2024-47565 | Medium | 4.3 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate that user input comp… |
CVE-2024-47563 | Medium | 5.3 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate a file path that is… |
CVE-2024-47562 | High | 8.8 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements i… |
CVE-2024-47553 | Critical | 9.9 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ``… |
CVE-2024-47196 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in affected applications allows a specific… |
CVE-2024-47195 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in affected applications allows a specific e… |
CVE-2024-47194 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in affected applications allows a specific… |
CVE-2024-47046 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simcenter Femap V2406 (All versions). The af… |
CVE-2024-46887 | Medium | 5.3 | 2024-10-08 | The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenti… |
CVE-2024-46886 | Medium | 4.7 | 2024-10-08 | The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redire… |
CVE-2024-45476 | Low | 3.3 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45475 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45474 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45473 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45472 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45471 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45470 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45469 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45468 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45467 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45466 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45465 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45464 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45463 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-41981 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simcenter Femap V2406 (All versions). The af… |
CVE-2024-41902 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-based buffer overflow vulnerability that co… |
CVE-2024-41798 | Critical | 9.8 | 2024-10-08 | A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access vi… |
CVE-2024-8964 | Medium | 6.4 | 2024-10-08 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and i… |
CVE-2024-47095 | | 2024-10-08 | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the exp… | |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-34672 | Medium | 5.5 | 2024-10-08 | Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows local att… |
CVE-2024-34671 | Low | 3.3 | 2024-10-08 | Use of implicit intent for sensitive communication in translation혻in Samsung Internet prior to version 26.0.3.1 allows local attackers to get sensitive informa… |
CVE-2024-34670 | Medium | 4.0 | 2024-10-08 | Use of implicit intent for sensitive communication in Sound Assistant prior to version 6.1.0.9 allows local attackers to get sensitive information. |
CVE-2024-34669 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system… |
CVE-2024-34668 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34667 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34666 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary… |
CVE-2024-34665 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34664 | Medium | 4.1 | 2024-10-08 | Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environmen… |
CVE-2024-34663 | Medium | 5.3 | 2024-10-08 | Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2024-34662 | Medium | 6.2 | 2024-10-08 | Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Release 1 in select Android 14 allows loca… |
CVE-2024-9292 | Medium | 6.4 | 2024-10-08 | The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 3.2.0 due to ins… |
CVE-2024-9021 | Medium | 5.4 | 2024-10-08 | In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Co… |
CVE-2024-8983 | Medium | 4.8 | 2024-10-08 | Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-21533 | Medium | 6.5 | 2024-10-08 | All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the fi… |
CVE-2024-21532 | High | 7.3 | 2024-10-08 | All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched… |
CVE-2024-9026 | Low | 3.3 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through cat… |
CVE-2024-8927 | High | 7.5 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is bein… |
CVE-2024-8926 | High | 8.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes… |
CVE-2024-8925 | Low | 3.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could… |
CVE-2024-47594 | Medium | 5.4 | 2024-10-08 | SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An a… |
CVE-2024-45382 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write. |
CVE-2024-45282 | Medium | 4.3 | 2024-10-08 | Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an ODat… |
CVE-2024-45278 | Medium | 5.4 | 2024-10-08 | SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitati… |
CVE-2024-45277 | Medium | 4.3 | 2024-10-08 | The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary p… |
CVE-2024-43697 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-43696 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak. |
CVE-2024-39831 | Medium | 4.4 | 2024-10-08 | in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-39806 | Medium | 5.5 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-37179 | High | 7.7 | 2024-10-08 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to… |
CVE-2024-47969 | Medium | 6.2 | 2024-10-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47968 | Medium | 4.4 | 2024-10-07 | Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47818 | Medium | 6.5 | 2024-10-07 | Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by ca… |
CVE-2024-47817 | Medium | 6.1 | 2024-10-07 | Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes… |
CVE-2024-47814 | Low | 3.9 | 2024-10-07 | Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto c… |
CVE-2024-47782 | High | 7.6 | 2024-10-07 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on t… |
CVE-2024-47781 | Medium | 6.1 | 2024-10-07 | CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user… |
CVE-2024-45874 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the s… |
CVE-2024-45873 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in th… |
CVE-2024-47974 | Medium | 4.4 | 2024-10-07 | Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47973 | Medium | 5.1 | 2024-10-07 | In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker. |
CVE-2024-47967 | Medium | 4.4 | 2024-10-07 | Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47772 | Medium | 6.5 | 2024-10-07 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted… |
CVE-2024-47610 | High | 7.3 | 2024-10-07 | InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown… |
CVE-2024-45919 | Medium | 6.5 | 2024-10-07 | A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Ty… |
CVE-2024-45297 | Medium | 5.3 | 2024-10-07 | Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has b… |
CVE-2024-45291 | Medium | 6.3 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from… |
CVE-2024-45290 | High | 7.7 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from… |
CVE-2024-45060 | High | 7.1 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scri… |
CVE-2024-45051 | High | 8.2 | 2024-10-07 | Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions… |
CVE-2024-43789 | High | 7.5 | 2024-10-07 | Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can… |
CVE-2024-43365 | Medium | 5.7 | 2024-10-07 | Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in li… |
CVE-2024-43364 | Medium | 5.7 | 2024-10-07 | Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . M… |
CVE-2024-43363 | High | 7.2 | 2024-10-07 | Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat… |
CVE-2024-43362 | High | 7.3 | 2024-10-07 | Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php`… |