2024 CVEs (page 17)
Page 17 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51800 | Critical | 9.8 | 2025-04-04 | Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1. |
CVE-2024-42208 | Low | 3.5 | 2025-04-04 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2024-13898 | Medium | 4.4 | 2025-04-04 | The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Sto… |
CVE-2024-13708 | High | 7.2 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficie… |
CVE-2024-13645 | Critical | 9.8 | 2025-04-04 | The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes i… |
CVE-2024-13744 | High | 8.1 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fiel… |
CVE-2024-56528 | High | 7.5 | 2025-04-03 | This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending… |
CVE-2024-47217 | Medium | 6.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can render Iglu Server com… |
CVE-2024-47215 | High | 7.5 | 2025-04-03 | An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events… |
CVE-2024-47214 | High | 7.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payload. As above, it can… |
CVE-2024-47213 | High | 7.5 | 2025-04-03 | An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event a… |
CVE-2024-47212 | High | 7.5 | 2025-04-03 | An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it… |
CVE-2024-45199 | High | 8.8 | 2025-04-03 | insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JND… |
CVE-2024-45198 | High | 8.8 | 2025-04-03 | insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injec… |
CVE-2024-22611 | Critical | 9.8 | 2025-04-03 | OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php. |
CVE-2024-4877 | High | 8.8 | 2025-04-03 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would conn… |
CVE-2024-9416 | Medium | 6.4 | 2025-04-03 | The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5… |
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |
CVE-2024-13673 | Medium | 6.4 | 2025-04-03 | The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and inc… |
CVE-2024-38392 | Critical | 9.1 | 2025-04-02 | Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application… |
CVE-2024-37917 | High | 7.5 | 2025-04-02 | Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling… |
CVE-2024-36337 | High | 7.9 | 2025-04-02 | Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of confidentiality, integrity or availa… |
CVE-2024-36336 | High | 7.9 | 2025-04-02 | Integer overflow within the AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to a loss of confidentiality, integrity, or… |
CVE-2024-36328 | High | 7.3 | 2025-04-02 | Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of integrity or availability. |
CVE-2024-56476 | Medium | 5.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy. |
CVE-2024-56475 | Medium | 5.4 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScri… |
CVE-2024-56474 | Medium | 4.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2024-56341 | Medium | 5.4 | 2025-04-02 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaS… |
CVE-2024-25051 | Medium | 6.6 | 2025-04-02 | IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another u… |
CVE-2024-50597 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50596 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted networ… |
CVE-2024-50595 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |
CVE-2024-50594 | Medium | 4.3 | 2025-04-02 | An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series… |
CVE-2024-50385 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-50384 | Medium | 6.5 | 2025-04-02 | A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted netw… |
CVE-2024-45064 | High | 8.5 | 2025-04-02 | A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set… |
CVE-2024-13637 | Medium | 6.5 | 2025-04-02 | The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin function in al… |
CVE-2024-12410 | Medium | 4.9 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to… |
CVE-2024-39780 | High | 7.8 | 2025-04-02 | A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameter… |
CVE-2024-45700 | Medium | 6.5 | 2025-04-02 | Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, whic… |
CVE-2024-45699 | Medium | 5.4 | 2025-04-02 | The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection… |
CVE-2024-42325 | Low | 3.5 | 2025-04-02 | Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. |
CVE-2024-36469 | Low | 3.1 | 2025-04-02 | Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. |
CVE-2024-36465 | High | 8.8 | 2025-04-02 | A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL comma… |
CVE-2024-13941 | Medium | 5.3 | 2025-04-01 | A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convert_zip_date_time… |
CVE-2024-13553 | Critical | 9.8 | 2025-04-01 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incl… |
CVE-2024-56325 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -… |
CVE-2024-12278 | High | 7.2 | 2025-04-01 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data using wp_kses, lik… |
CVE-2024-12189 | Medium | 6.4 | 2025-04-01 | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc… |
CVE-2024-13567 | High | 7.5 | 2025-04-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2024-54533 | High | 7.0 | 2025-03-31 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A… |
CVE-2024-40864 | Low | 2.7 | 2025-03-31 | The issue was addressed with improved handling of protocols. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2024-54809 | Critical | 9.8 | 2025-03-31 | Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header p… |
CVE-2024-54808 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained… |
CVE-2024-54807 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient pa… |
CVE-2024-54806 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web int… |
CVE-2024-54805 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54804 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54803 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54802 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header. |
CVE-2024-24456 | Medium | 5.9 | 2025-03-31 | An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow. |
CVE-2024-12021 | | 2025-03-31 | Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may re… | |
CVE-2024-55093 | Medium | 5.4 | 2025-03-31 | phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. |
CVE-2024-13804 | Critical | 9.8 | 2025-03-30 | Unauthenticated RCE in HPE Insight Cluster Management Utility |
CVE-2024-55895 | Low | 2.7 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-11180 | Medium | 6.4 | 2025-03-29 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title pa… |
CVE-2024-13557 | Medium | 6.5 | 2025-03-29 | The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.1.6. This is due to… |
CVE-2024-7577 | Medium | 4.4 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. |
CVE-2024-51477 | Medium | 4.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. |
CVE-2024-43186 | Medium | 5.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. |
CVE-2024-58130 | High | 7.2 | 2025-03-28 | In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses. |
CVE-2024-58129 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can… |
CVE-2024-58128 | Medium | 5.5 | 2025-03-28 | In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin privileges can cond… |
CVE-2024-6875 | Medium | 6.5 | 2025-03-28 | A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur wh… |
CVE-2024-57083 | High | 7.5 | 2025-03-28 | A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS)… |
CVE-2024-56975 | Critical | 9.8 | 2025-03-28 | InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Uplo… |
CVE-2024-38988 | Critical | 9.8 | 2025-03-28 | alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attacke… |
CVE-2024-38985 | Critical | 9.8 | 2025-03-28 | janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vu… |
CVE-2024-24292 | Critical | 9.8 | 2025-03-28 | A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. |
CVE-2024-54362 | High | 8.1 | 2025-03-28 | Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a… |
CVE-2024-54291 | High | 8.6 | 2025-03-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows M… |
CVE-2024-51624 | High | 7.1 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-… |
CVE-2024-48615 | High | 7.5 | 2025-03-28 | Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_form… |
CVE-2024-39311 | Medium | 5.4 | 2025-03-28 | Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core`… |
CVE-2024-7407 | | 2025-03-28 | Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are st… | |
CVE-2024-11504 | | 2025-03-28 | Input from multiple fields in Streamsoft Prestiż is not sanitized properly, leading to an SQL injection vulnerability, which might be exploited by an authentic… | |
CVE-2024-12619 | Medium | 5.2 | 2025-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal us… |
CVE-2024-10307 | Medium | 4.3 | 2025-03-28 | An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously craft… |
CVE-2024-49601 | High | 7.3 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-13939 | High | 7.5 | 2025-03-28 | String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated… |
CVE-2024-49565 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49564 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-49563 | High | 7.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2024-55070 | Low | 3.1 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own per… |
CVE-2024-55073 | High | 7.6 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-55072 | Medium | 5.4 | 2025-03-27 | A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in orde… |
CVE-2024-12905 | High | 7.5 | 2025-03-27 | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vuln… |
CVE-2024-58091 | High | 7.8 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Add shadow buffering for deferred I/O DMA areas are not necessarily backed… |
CVE-2024-58090 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning ob… |
CVE-2024-56469 | Medium | 6.3 | 2025-03-27 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1… |