2024 CVEs (page 17)
Page 17 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50385 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-50384 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-45064 | High | 8.5 | 2025-04-02 | A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set… |
CVE-2024-13637 | Medium | 6.5 | 2025-04-02 | The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin function in al… |
CVE-2024-12410 | Medium | 4.9 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to… |
CVE-2024-39780 | High | 7.8 | 2025-04-02 | A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameter… |
CVE-2024-45700 | Medium | 6.5 | 2025-04-02 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, whic… |
CVE-2024-45699 | Medium | 5.4 | 2025-04-02 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection… |
CVE-2024-42325 | Low | 3.5 | 2025-04-02 | Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. |
CVE-2024-36469 | Low | 3.1 | 2025-04-02 | Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. |
CVE-2024-36465 | High | 8.8 | 2025-04-02 | A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL comma… |
CVE-2024-13941 | Medium | 5.3 | 2025-04-01 | A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convert_zip_date_time… |
CVE-2024-13553 | Critical | 9.8 | 2025-04-01 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incl… |
CVE-2024-56325 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -… |
CVE-2024-12278 | High | 7.2 | 2025-04-01 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data using wp_kses, lik… |
CVE-2024-12189 | Medium | 6.4 | 2025-04-01 | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc… |
CVE-2024-13567 | High | 7.5 | 2025-04-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2024-54533 | High | 7.0 | 2025-03-31 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A… |
CVE-2024-40864 | Low | 2.7 | 2025-03-31 | The issue was addressed with improved handling of protocols. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2024-54809 | Critical | 9.8 | 2025-03-31 | Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header p… |
CVE-2024-54808 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained… |
CVE-2024-54807 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient pa… |
CVE-2024-54806 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web int… |
CVE-2024-54805 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54804 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54803 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54802 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header. |
CVE-2024-24456 | Medium | 5.9 | 2025-03-31 | An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow. |
CVE-2024-12021 | | 2025-03-31 | Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may re… | |
CVE-2024-55093 | Medium | 5.4 | 2025-03-31 | phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. |
CVE-2024-13804 | Critical | 9.8 | 2025-03-30 | Unauthenticated RCE in HPE Insight Cluster Management Utility |
CVE-2024-55895 | Low | 2.7 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-11180 | Medium | 6.4 | 2025-03-29 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title pa… |
CVE-2024-13557 | Medium | 6.5 | 2025-03-29 | The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.1.6. This is due to… |
CVE-2024-7577 | Medium | 4.4 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. |
CVE-2024-51477 | Medium | 4.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. |
CVE-2024-43186 | Medium | 5.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. |
CVE-2024-58130 | High | 7.2 | 2025-03-28 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. |
CVE-2024-58129 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can… |
CVE-2024-58128 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can cond… |
CVE-2024-6875 | Medium | 6.5 | 2025-03-28 | A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur wh… |
CVE-2024-57083 | High | 7.5 | 2025-03-28 | A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS)… |
CVE-2024-56975 | Critical | 9.8 | 2025-03-28 | InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Uplo… |
CVE-2024-38988 | Critical | 9.8 | 2025-03-28 | alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attacke… |
CVE-2024-38985 | Critical | 9.8 | 2025-03-28 | janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vu… |
CVE-2024-24292 | Critical | 9.8 | 2025-03-28 | A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. |
CVE-2024-54362 | High | 8.1 | 2025-03-28 | Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a… |
CVE-2024-54291 | High | 8.6 | 2025-03-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows M… |
CVE-2024-51624 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-… |
CVE-2024-48615 | High | 7.5 | 2025-03-28 | Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_form… |
CVE-2024-39311 | Medium | 5.4 | 2025-03-28 | Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core`… |
CVE-2024-7407 | | 2025-03-28 | Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are st… | |
CVE-2024-11504 | | 2025-03-28 | Input from multiple fields in Streamsoft Prestiż is not sanitized properly, leading to an SQL injection vulnerability, which might be exploited by an authentic… | |
CVE-2024-12619 | Medium | 5.2 | 2025-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal us… |
CVE-2024-10307 | Medium | 4.3 | 2025-03-28 | An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously craft… |
CVE-2024-49601 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-13939 | High | 7.5 | 2025-03-28 | String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated… |
CVE-2024-49565 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49564 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49563 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-55070 | Low | 3.1 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own per… |
CVE-2024-55073 | High | 7.6 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-55072 | Medium | 5.4 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-12905 | High | 7.5 | 2025-03-27 | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vuln… |
CVE-2024-58091 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed… |
CVE-2024-58090 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning ob… |
CVE-2024-56469 | Medium | 6.3 | 2025-03-27 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1… |
CVE-2024-48944 | Medium | 6.5 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api o… |
CVE-2024-9773 | Low | 3.7 | 2025-03-27 | An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions start… |
CVE-2024-45361 | Medium | 6.5 | 2025-03-27 | A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited b… |
CVE-2024-45356 | High | 7.3 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45355 | Medium | 5.5 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45354 | Medium | 4.3 | 2025-03-27 | A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by a… |
CVE-2024-45353 | Medium | 4.3 | 2025-03-27 | An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and c… |
CVE-2024-45352 | High | 8.8 | 2025-03-27 | An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploit… |
CVE-2024-55965 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically… |
CVE-2024-55964 | Critical | 9.8 | 2025-03-26 | An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside t… |
CVE-2024-55963 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a serv… |
CVE-2024-41643 | Medium | 6.8 | 2025-03-26 | An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component. |
CVE-2024-45351 | High | 7.8 | 2025-03-26 | A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be explo… |
CVE-2024-13889 | High | 7.2 | 2025-03-26 | The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted… |
CVE-2024-13411 | Medium | 6.4 | 2025-03-26 | The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() f… |
CVE-2024-13801 | High | 8.1 | 2025-03-26 | The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capa… |
CVE-2024-13702 | Medium | 6.4 | 2025-03-26 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSched… |
CVE-2024-30155 | Medium | 5.5 | 2025-03-26 | HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values vi… |
CVE-2024-13146 | High | 8.8 | 2025-03-26 | The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbi… |
CVE-2024-12683 | Low | 3.5 | 2025-03-26 | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-11847 | Medium | 4.8 | 2025-03-26 | The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious J… |
CVE-2024-47516 | Critical | 9.8 | 2025-03-26 | A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure insta… |
CVE-2024-55030 | Critical | 9.8 | 2025-03-25 | A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. |
CVE-2024-55029 | Medium | 6.1 | 2025-03-25 | NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2024-55028 | Critical | 9.8 | 2025-03-25 | A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. |
CVE-2024-48818 | Critical | 9.8 | 2025-03-25 | An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. |
CVE-2024-31896 | Medium | 5.9 | 2025-03-25 | IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2024-58105 | High | 7.3 | 2025-03-25 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute… |
CVE-2024-58104 | High | 7.3 | 2025-03-25 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute… |
CVE-2024-55604 | Medium | 4.3 | 2025-03-25 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information o… |
CVE-2024-42533 | Critical | 9.8 | 2025-03-25 | SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitrary code via the GES… |
CVE-2024-12169 | Medium | 6.5 | 2025-03-25 | A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific at… |
CVE-2024-11499 | Medium | 4.9 | 2025-03-25 | A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restar… |