2024 CVEs (page 16)
Page 16 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52981 | Medium | 4.9 | 2025-04-08 | An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause… |
CVE-2024-52980 | Medium | 6.5 | 2025-04-08 | A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elast… |
CVE-2024-52974 | Medium | 6.5 | 2025-04-08 | An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requir… |
CVE-2024-48887 | Critical | 9.8 | 2025-04-08 | A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially c… |
CVE-2024-54025 | Medium | 6.7 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before versi… |
CVE-2024-54024 | High | 7.2 | 2025-04-08 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2… |
CVE-2024-52962 | Medium | 5.3 | 2025-04-08 | An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below… |
CVE-2024-50565 | Low | 3.1 | 2025-04-08 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7… |
CVE-2024-46671 | Medium | 6.2 | 2025-04-08 | An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and… |
CVE-2024-32122 | Low | 2.3 | 2025-04-08 | A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versio… |
CVE-2024-26013 | High | 7.5 | 2025-04-08 | A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7… |
CVE-2024-54092 | Critical | 9.8 | 2025-04-08 | A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Indust… |
CVE-2024-41796 | Medium | 6.5 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login passwo… |
CVE-2024-41795 | Medium | 6.5 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Reque… |
CVE-2024-41794 | Critical | 10.0 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the… |
CVE-2024-41793 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows… |
CVE-2024-41792 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnera… |
CVE-2024-41791 | High | 7.3 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report crea… |
CVE-2024-41790 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region para… |
CVE-2024-41789 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language pa… |
CVE-2024-41788 | Critical | 9.1 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input param… |
CVE-2024-47261 | Medium | 4.3 | 2025-04-08 | 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an a… |
CVE-2024-13820 | Medium | 5.3 | 2025-04-08 | The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, whi… |
CVE-2024-46494 | Medium | 5.4 | 2025-04-07 | A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name… |
CVE-2024-38797 | Medium | 4.6 | 2025-04-07 | EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjece… |
CVE-2024-49848 | Medium | 6.7 | 2025-04-07 | Memory corruption while processing multiple IOCTL calls from HLOS to DSP. |
CVE-2024-45557 | High | 7.8 | 2025-04-07 | Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation. |
CVE-2024-45556 | Medium | 6.5 | 2025-04-07 | Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR. |
CVE-2024-45552 | High | 8.2 | 2025-04-07 | Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. |
CVE-2024-45551 | Medium | 6.2 | 2025-04-07 | Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to… |
CVE-2024-45549 | High | 7.7 | 2025-04-07 | Information disclosure while creating MQ channels. |
CVE-2024-45544 | Medium | 6.6 | 2025-04-07 | Memory corruption while processing IOCTL calls to add route entry in the HW. |
CVE-2024-45543 | Medium | 6.6 | 2025-04-07 | Memory corruption while accessing MSM channel map and mixer functions. |
CVE-2024-45540 | Medium | 6.6 | 2025-04-07 | Memory corruption while invoking IOCTL map buffer request from userspace. |
CVE-2024-43067 | High | 7.8 | 2025-04-07 | Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory. |
CVE-2024-43066 | High | 7.8 | 2025-04-07 | Memory corruption while handling file descriptor during listener registration/de-registration. |
CVE-2024-43065 | High | 7.1 | 2025-04-07 | Cryptographic issues while generating an asymmetric key pair for RKP use cases. |
CVE-2024-43058 | High | 7.8 | 2025-04-07 | Memory corruption while processing IOCTL calls. |
CVE-2024-43046 | Medium | 5.5 | 2025-04-07 | There may be information disclosure during memory re-allocation in TZ Secure OS. |
CVE-2024-33058 | High | 7.5 | 2025-04-07 | Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP. |
CVE-2024-11859 | | 2025-04-07 | DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its… | |
CVE-2024-11071 | High | 8.8 | 2025-04-07 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and… |
CVE-2024-58127 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58126 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58125 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58124 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58116 | Medium | 4.0 | 2025-04-07 | Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58115 | Medium | 4.0 | 2025-04-07 | Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58113 | Medium | 5.3 | 2025-04-07 | Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58112 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58111 | High | 7.5 | 2025-04-07 | Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may affect avail… |
CVE-2024-58110 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58109 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58108 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58107 | High | 7.5 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58106 | Medium | 4.6 | 2025-04-07 | Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58133 | Medium | 4.0 | 2025-04-06 | In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logg… |
CVE-2024-58132 | Medium | 4.0 | 2025-04-06 | In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and w… |
CVE-2024-58131 | Medium | 4.0 | 2025-04-06 | FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the cod… |
CVE-2024-56370 | Medium | 6.5 | 2025-04-05 | Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functi… |
CVE-2024-52322 | Medium | 5.5 | 2025-04-05 | WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-58036 | Medium | 5.5 | 2025-04-05 | Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic… |
CVE-2024-57868 | Medium | 5.5 | 2025-04-05 | Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions… |
CVE-2024-57835 | Medium | 5.5 | 2025-04-05 | Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generat… |
CVE-2024-13776 | High | 8.1 | 2025-04-05 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of… |
CVE-2024-13604 | High | 7.5 | 2025-04-05 | The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-11235 | High | 8.1 | 2025-04-04 | In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-fre… |
CVE-2024-51800 | Critical | 9.8 | 2025-04-04 | Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1. |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2024-13898 | Medium | 4.4 | 2025-04-04 | The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Sto… |
CVE-2024-13708 | High | 7.2 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficie… |
CVE-2024-13645 | Critical | 9.8 | 2025-04-04 | The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes i… |
CVE-2024-13744 | High | 8.1 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fiel… |
CVE-2024-56528 | High | 7.5 | 2025-04-03 | This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending… |
CVE-2024-47217 | Medium | 6.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can render Iglu Server com… |
CVE-2024-47215 | High | 7.5 | 2025-04-03 | An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events… |
CVE-2024-47214 | High | 7.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payload. As above, it can… |
CVE-2024-47213 | High | 7.5 | 2025-04-03 | An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event a… |
CVE-2024-47212 | High | 7.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it… |
CVE-2024-45199 | High | 8.8 | 2025-04-03 | insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JND… |
CVE-2024-45198 | High | 8.8 | 2025-04-03 | insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injec… |
CVE-2024-22611 | Critical | 9.8 | 2025-04-03 | OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php. |
CVE-2024-4877 | High | 8.8 | 2025-04-03 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would conn… |
CVE-2024-9416 | Medium | 6.4 | 2025-04-03 | The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5… |
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |
CVE-2024-13673 | Medium | 6.4 | 2025-04-03 | The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and inc… |
CVE-2024-38392 | Critical | 9.1 | 2025-04-02 | Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application… |
CVE-2024-37917 | High | 7.5 | 2025-04-02 | Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling… |
CVE-2024-36337 | High | 7.9 | 2025-04-02 | Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of confidentiality, integrity or availa… |
CVE-2024-36336 | High | 7.9 | 2025-04-02 | Integer overflow within the AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to a loss of confidentiality, integrity, or… |
CVE-2024-36328 | High | 7.3 | 2025-04-02 | Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of integrity or availability. |
CVE-2024-56476 | Medium | 5.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy. |
CVE-2024-56475 | Medium | 5.4 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScri… |
CVE-2024-56474 | Medium | 4.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2024-56341 | Medium | 5.4 | 2025-04-02 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaS… |
CVE-2024-25051 | Medium | 6.6 | 2025-04-02 | IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another u… |
CVE-2024-50597 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50596 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50595 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |
CVE-2024-50594 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |