2024 CVEs (page 16)
Page 16 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49709 | Medium | 4.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser mig… |
CVE-2024-49708 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into fillin… |
CVE-2024-49707 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-49706 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent i… |
CVE-2024-49705 | Medium | 6.5 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into usin… |
CVE-2024-13598 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. Using a functionality of creating new… |
CVE-2024-13597 | | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… | |
CVE-2024-10090 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-10089 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into fillin… |
CVE-2024-10088 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into fil… |
CVE-2024-10087 | Medium | 5.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containi… |
CVE-2024-9230 | Medium | 5.9 | 2025-04-14 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which coul… |
CVE-2024-56406 | High | 8.4 | 2025-04-13 | A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.3… |
CVE-2024-13338 | Medium | 5.3 | 2025-04-12 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… |
CVE-2024-13337 | Medium | 4.3 | 2025-04-12 | The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version… |
CVE-2024-11679 | Medium | 4.4 | 2025-04-11 | An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privi… |
CVE-2024-13861 | High | 7.8 | 2025-04-11 | A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code ex… |
CVE-2024-52280 | High | 7.7 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to acces… |
CVE-2024-52282 | Medium | 6.2 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Cata… |
CVE-2024-51461 | Medium | 4.3 | 2025-04-11 | IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume… |
CVE-2024-11129 | Medium | 6.3 | 2025-04-10 | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers… |
CVE-2024-38865 | High | 8.8 | 2025-04-10 | Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allow… |
CVE-2024-13909 | Medium | 4.9 | 2025-04-10 | The Accredible Certificates & Open Badges plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and… |
CVE-2024-13896 | Medium | 6.5 | 2025-04-10 | The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression… |
CVE-2024-13874 | High | 7.1 | 2025-04-10 | The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-10894 | Medium | 6.4 | 2025-04-10 | The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and… |
CVE-2024-58136 | Critical | 9.0 | 2025-04-10 | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in Febru… |
CVE-2024-55210 | Critical | 9.8 | 2025-04-09 | An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message. |
CVE-2024-8243 | Medium | 6.3 | 2025-04-09 | The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escap… |
CVE-2024-6860 | Medium | 4.3 | 2025-04-09 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make… |
CVE-2024-6857 | Medium | 4.3 | 2025-04-09 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow atta… |
CVE-2024-55354 | High | 8.8 | 2025-04-08 | Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let a… |
CVE-2024-12556 | High | 8.7 | 2025-04-08 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. |
CVE-2024-52981 | Medium | 4.9 | 2025-04-08 | An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause… |
CVE-2024-52980 | Medium | 6.5 | 2025-04-08 | A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elast… |
CVE-2024-52974 | Medium | 6.5 | 2025-04-08 | An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requir… |
CVE-2024-48887 | Critical | 9.8 | 2025-04-08 | A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially c… |
CVE-2024-54025 | Medium | 6.7 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before versi… |
CVE-2024-54024 | High | 7.2 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2… |
CVE-2024-52962 | Medium | 5.3 | 2025-04-08 | An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below… |
CVE-2024-50565 | Low | 3.1 | 2025-04-08 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7… |
CVE-2024-46671 | Medium | 6.2 | 2025-04-08 | An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and… |
CVE-2024-32122 | Low | 2.3 | 2025-04-08 | A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versio… |
CVE-2024-26013 | High | 7.5 | 2025-04-08 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7… |
CVE-2024-54092 | Critical | 9.8 | 2025-04-08 | A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Indust… |
CVE-2024-41796 | Medium | 6.5 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login passwo… |
CVE-2024-41795 | Medium | 6.5 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Reque… |
CVE-2024-41794 | Critical | 10.0 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the… |
CVE-2024-41793 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows… |
CVE-2024-41792 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnera… |
CVE-2024-41791 | High | 7.3 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report crea… |
CVE-2024-41790 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region para… |
CVE-2024-41789 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language pa… |
CVE-2024-41788 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input param… |
CVE-2024-47261 | Medium | 4.3 | 2025-04-08 | 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an a… |
CVE-2024-13820 | Medium | 5.3 | 2025-04-08 | The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, whi… |
CVE-2024-46494 | Medium | 5.4 | 2025-04-07 | A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name… |
CVE-2024-38797 | Medium | 4.6 | 2025-04-07 | EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjece… |
CVE-2024-49848 | Medium | 6.7 | 2025-04-07 | Memory corruption while processing multiple IOCTL calls from HLOS to DSP. |
CVE-2024-45557 | High | 7.8 | 2025-04-07 | Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. |
CVE-2024-45556 | Medium | 6.5 | 2025-04-07 | Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR. |
CVE-2024-45552 | High | 8.2 | 2025-04-07 | Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. |
CVE-2024-45551 | Medium | 6.2 | 2025-04-07 | Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to… |
CVE-2024-45549 | High | 7.7 | 2025-04-07 | Information disclosure while creating MQ channels. |
CVE-2024-45544 | Medium | 6.6 | 2025-04-07 | Memory corruption while processing IOCTL calls to add route entry in the HW. |
CVE-2024-45543 | Medium | 6.6 | 2025-04-07 | Memory corruption while accessing MSM channel map and mixer functions. |
CVE-2024-45540 | Medium | 6.6 | 2025-04-07 | Memory corruption while invoking IOCTL map buffer request from userspace. |
CVE-2024-43067 | High | 7.8 | 2025-04-07 | Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory. |
CVE-2024-43066 | High | 7.8 | 2025-04-07 | Memory corruption while handling file descriptor during listener registration/de-registration. |
CVE-2024-43065 | High | 7.1 | 2025-04-07 | Cryptographic issues while generating an asymmetric key pair for RKP use cases. |
CVE-2024-43058 | High | 7.8 | 2025-04-07 | Memory corruption while processing IOCTL calls. |
CVE-2024-43046 | Medium | 5.5 | 2025-04-07 | There may be information disclosure during memory re-allocation in TZ Secure OS. |
CVE-2024-33058 | High | 7.5 | 2025-04-07 | Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP. |
CVE-2024-11859 | | 2025-04-07 | DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its… | |
CVE-2024-11071 | High | 8.8 | 2025-04-07 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and… |
CVE-2024-58127 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58126 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58125 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58124 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58116 | Medium | 4.0 | 2025-04-07 | Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58115 | Medium | 4.0 | 2025-04-07 | Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58113 | Medium | 5.3 | 2025-04-07 | Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58112 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58111 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58110 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58109 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58108 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58107 | High | 7.5 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58106 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58133 | Medium | 4.0 | 2025-04-06 | In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logg… |
CVE-2024-58132 | Medium | 4.0 | 2025-04-06 | In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and w… |
CVE-2024-58131 | Medium | 4.0 | 2025-04-06 | FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the cod… |
CVE-2024-56370 | Medium | 6.5 | 2025-04-05 | Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functi… |
CVE-2024-52322 | Medium | 5.5 | 2025-04-05 | WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-58036 | Medium | 5.5 | 2025-04-05 | Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-57868 | Medium | 5.5 | 2025-04-05 | Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions… |
CVE-2024-57835 | Medium | 5.5 | 2025-04-05 | Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generat… |
CVE-2024-13776 | High | 8.1 | 2025-04-05 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of… |
CVE-2024-13604 | High | 7.5 | 2025-04-05 | The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-11235 | High | 8.1 | 2025-04-04 | In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-fre… |