2024 CVEs (page 153)
Page 153 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9622 | Medium | 5.3 | 2024-10-08 | A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling req… |
CVE-2024-9621 | Medium | 5.3 | 2024-10-08 | A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. Th… |
CVE-2024-9620 | Medium | 5.3 | 2024-10-08 | A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with netwo… |
CVE-2024-9381 | High | 7.2 | 2024-10-08 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. |
CVE-2024-9380 | High | 7.2 | 2024-10-08 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges… |
CVE-2024-9379 | Medium | 6.5 | 2024-10-08 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL sta… |
CVE-2024-9167 | High | 7.8 | 2024-10-08 | Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local… |
CVE-2024-9124 | High | 7.5 | 2024-10-08 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 600T. If the device is overloaded with requests, it will become unavailable. The… |
CVE-2024-8626 | High | 7.5 | 2024-10-08 | Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability… |
CVE-2024-7612 | High | 8.8 | 2024-10-08 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. |
CVE-2024-47011 | High | 7.5 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information |
CVE-2024-47010 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47009 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47008 | High | 7.5 | 2024-10-08 | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. |
CVE-2024-47007 | High | 7.5 | 2024-10-08 | A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of ser… |
CVE-2024-45918 | Critical | 9.8 | 2024-10-08 | Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php. |
CVE-2024-44349 | Critical | 9.8 | 2024-10-08 | A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username p… |
CVE-2024-3057 | Critical | 9.8 | 2024-10-08 | A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation. |
CVE-2024-8215 | High | 8.4 | 2024-10-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modul… |
CVE-2024-47951 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings |
CVE-2024-47950 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47161 | Medium | 4.3 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API |
CVE-2024-45231 | Medium | 5.3 | 2024-10-08 | An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password… |
CVE-2024-45230 | High | 7.5 | 2024-10-08 | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a p… |
CVE-2024-45880 | High | 8.0 | 2024-10-08 | A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system… |
CVE-2024-45330 | High | 7.2 | 2024-10-08 | A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privil… |
CVE-2024-33506 | Low | 3.3 | 2024-10-08 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows… |
CVE-2024-8482 | Medium | 6.4 | 2024-10-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and i… |
CVE-2024-8431 | Medium | 4.3 | 2024-10-08 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-9207 | Medium | 6.1 | 2024-10-08 | The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the… |
CVE-2024-9005 | | 2024-10-08 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is… | |
CVE-2024-8884 | Critical | 9.8 | 2024-10-08 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attacker has access to a… |
CVE-2024-8488 | Medium | 4.4 | 2024-10-08 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insuffi… |
CVE-2024-8629 | Medium | 6.1 | 2024-10-08 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wit… |
CVE-2024-8518 | Low | 3.3 | 2024-10-08 | CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted project file is loaded… |
CVE-2024-8433 | Medium | 6.4 | 2024-10-08 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' par… |
CVE-2024-8422 | High | 7.8 | 2024-10-08 | CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when applicat… |
CVE-2024-3506 | Medium | 6.7 | 2024-10-08 | A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on… |
CVE-2024-8943 | Critical | 9.8 | 2024-10-08 | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification o… |
CVE-2024-8911 | Critical | 9.8 | 2024-10-08 | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to i… |
CVE-2024-47565 | Medium | 4.3 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate that user input comp… |
CVE-2024-47563 | Medium | 5.3 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate a file path that is… |
CVE-2024-47562 | High | 8.8 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements i… |
CVE-2024-47553 | Critical | 9.9 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ``… |
CVE-2024-47196 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in affected applications allows a specific… |
CVE-2024-47195 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in affected applications allows a specific e… |
CVE-2024-47194 | Medium | 6.7 | 2024-10-08 | A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in affected applications allows a specific… |
CVE-2024-47046 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simcenter Femap V2406 (All versions). The af… |
CVE-2024-46887 | Medium | 5.3 | 2024-10-08 | The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenti… |
CVE-2024-46886 | Medium | 4.7 | 2024-10-08 | The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redire… |
CVE-2024-45476 | Low | 3.3 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45475 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45474 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45473 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45472 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45471 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45470 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45469 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45468 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45467 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45466 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45465 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45464 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-45463 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-41981 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in Simcenter Femap V2306 (All versions), Simcenter Femap V2401 (All versions), Simcenter Femap V2406 (All versions). The af… |
CVE-2024-41902 | High | 7.8 | 2024-10-08 | A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-based buffer overflow vulnerability that co… |
CVE-2024-41798 | Critical | 9.8 | 2024-10-08 | A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access vi… |
CVE-2024-8964 | Medium | 6.4 | 2024-10-08 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and i… |
CVE-2024-47095 | | 2024-10-08 | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the exp… | |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-34672 | Medium | 5.5 | 2024-10-08 | Improper input validation in SamsungVideoPlayer prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows local att… |
CVE-2024-34671 | Low | 3.3 | 2024-10-08 | Use of implicit intent for sensitive communication in translation혻in Samsung Internet prior to version 26.0.3.1 allows local attackers to get sensitive informa… |
CVE-2024-34670 | Medium | 4.0 | 2024-10-08 | Use of implicit intent for sensitive communication in Sound Assistant prior to version 6.1.0.9 allows local attackers to get sensitive information. |
CVE-2024-34669 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system… |
CVE-2024-34668 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34667 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34666 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary… |
CVE-2024-34665 | High | 7.5 | 2024-10-08 | Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system p… |
CVE-2024-34664 | Medium | 4.1 | 2024-10-08 | Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environmen… |
CVE-2024-34663 | Medium | 5.3 | 2024-10-08 | Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2024-34662 | Medium | 6.2 | 2024-10-08 | Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Release 1 in select Android 14 allows loca… |
CVE-2024-9292 | Medium | 6.4 | 2024-10-08 | The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 3.2.0 due to ins… |
CVE-2024-9021 | Medium | 5.4 | 2024-10-08 | In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Co… |
CVE-2024-8983 | Medium | 4.8 | 2024-10-08 | Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-21533 | Medium | 6.5 | 2024-10-08 | All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the fi… |
CVE-2024-21532 | High | 7.3 | 2024-10-08 | All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched… |
CVE-2024-9026 | Low | 3.3 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through cat… |
CVE-2024-8927 | High | 7.5 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is bein… |
CVE-2024-8926 | High | 8.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes… |
CVE-2024-8925 | Low | 3.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could… |
CVE-2024-47594 | Medium | 5.4 | 2024-10-08 | SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An a… |
CVE-2024-45382 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write. |
CVE-2024-45282 | Medium | 4.3 | 2024-10-08 | Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an ODat… |
CVE-2024-45278 | Medium | 5.4 | 2024-10-08 | SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitati… |
CVE-2024-45277 | Medium | 4.3 | 2024-10-08 | The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary p… |
CVE-2024-43697 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-43696 | Low | 3.3 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak. |
CVE-2024-39831 | Medium | 4.4 | 2024-10-08 | in OpenHarmony v4.1.0 allow a local attacker with high privileges arbitrary code execution in pre-installed apps through use after free. |