2024 CVEs (page 18)
Page 18 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48944 | Medium | 6.5 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api o… |
CVE-2024-9773 | Low | 3.7 | 2025-03-27 | An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions start… |
CVE-2024-45361 | Medium | 6.5 | 2025-03-27 | A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited b… |
CVE-2024-45356 | High | 7.3 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45355 | Medium | 5.5 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45354 | Medium | 4.3 | 2025-03-27 | A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by a… |
CVE-2024-45353 | Medium | 4.3 | 2025-03-27 | An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and c… |
CVE-2024-45352 | High | 8.8 | 2025-03-27 | An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploit… |
CVE-2024-55965 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically… |
CVE-2024-55964 | Critical | 9.8 | 2025-03-26 | An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside t… |
CVE-2024-55963 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a serv… |
CVE-2024-41643 | Medium | 6.8 | 2025-03-26 | An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component. |
CVE-2024-45351 | High | 7.8 | 2025-03-26 | A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be explo… |
CVE-2024-13889 | High | 7.2 | 2025-03-26 | The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted… |
CVE-2024-13411 | Medium | 6.4 | 2025-03-26 | The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() f… |
CVE-2024-13801 | High | 8.1 | 2025-03-26 | The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capa… |
CVE-2024-13702 | Medium | 6.4 | 2025-03-26 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSched… |
CVE-2024-30155 | Medium | 5.5 | 2025-03-26 | HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values vi… |
CVE-2024-13146 | High | 8.8 | 2025-03-26 | The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbi… |
CVE-2024-12683 | Low | 3.5 | 2025-03-26 | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-11847 | Medium | 4.8 | 2025-03-26 | The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious J… |
CVE-2024-47516 | Critical | 9.8 | 2025-03-26 | A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure insta… |
CVE-2024-55030 | Critical | 9.8 | 2025-03-25 | A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. |
CVE-2024-55029 | Medium | 6.1 | 2025-03-25 | NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2024-55028 | Critical | 9.8 | 2025-03-25 | A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. |
CVE-2024-48818 | Critical | 9.8 | 2025-03-25 | An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. |
CVE-2024-31896 | Medium | 5.9 | 2025-03-25 | IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2024-58105 | High | 7.3 | 2025-03-25 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute… |
CVE-2024-58104 | High | 7.3 | 2025-03-25 | A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute… |
CVE-2024-55604 | Medium | 4.3 | 2025-03-25 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information o… |
CVE-2024-42533 | Critical | 9.8 | 2025-03-25 | SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitrary code via the GES… |
CVE-2024-12169 | Medium | 6.5 | 2025-03-25 | A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific at… |
CVE-2024-11499 | Medium | 4.9 | 2025-03-25 | A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restar… |
CVE-2024-10037 | Medium | 4.4 | 2025-03-25 | A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message seque… |
CVE-2024-53679 | Medium | 5.4 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficien… |
CVE-2024-53678 | High | 8.8 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when req… |
CVE-2024-13731 | Medium | 6.4 | 2025-03-25 | The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box bloc… |
CVE-2024-13710 | Medium | 4.3 | 2025-03-25 | The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due… |
CVE-2024-13690 | High | 7.2 | 2025-03-25 | The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to… |
CVE-2024-12623 | Medium | 6.4 | 2025-03-25 | The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10… |
CVE-2024-9770 | Medium | 4.7 | 2025-03-25 | The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inj… |
CVE-2024-44903 | High | 7.5 | 2025-03-25 | SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac… |
CVE-2024-13863 | High | 7.1 | 2025-03-25 | The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R… |
CVE-2024-13618 | High | 7.2 | 2025-03-25 | The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated… |
CVE-2024-13617 | High | 8.6 | 2025-03-25 | The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbit… |
CVE-2024-13123 | Low | 3.5 | 2025-03-25 | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2024-13122 | Low | 3.5 | 2025-03-25 | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2024-13118 | Medium | 4.3 | 2025-03-25 | The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs… |
CVE-2024-12769 | Low | 3.5 | 2025-03-25 | The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-12682 | Medium | 6.1 | 2025-03-25 | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12109 | Medium | 4.1 | 2025-03-25 | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, all… |
CVE-2024-11503 | Medium | 6.1 | 2025-03-25 | The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-11273 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-11272 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-10703 | Medium | 6.1 | 2025-03-25 | The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege u… |
CVE-2024-10679 | Medium | 6.1 | 2025-03-25 | The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-10638 | Medium | 4.1 | 2025-03-25 | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, al… |
CVE-2024-10566 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10565 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10560 | Low | 3.5 | 2025-03-25 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10554 | Low | 3.5 | 2025-03-25 | The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-10472 | Medium | 5.9 | 2025-03-25 | The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contri… |
CVE-2024-10210 | | 2025-03-25 | An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to… | |
CVE-2024-10105 | Medium | 5.9 | 2025-03-25 | The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor t… |
CVE-2024-8315 | | 2025-03-25 | An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker t… | |
CVE-2024-8314 | | 2025-03-25 | An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL… | |
CVE-2024-8313 | | 2025-03-25 | An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SN… | |
CVE-2024-45484 | | 2025-03-25 | An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an un… | |
CVE-2024-45483 | | 2025-03-25 | A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to… | |
CVE-2024-45482 | | 2025-03-25 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker fr… | |
CVE-2024-45481 | | 2025-03-25 | An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to a… | |
CVE-2024-45480 | | 2025-03-25 | An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticat… | |
CVE-2024-10209 | | 2025-03-25 | An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker t… | |
CVE-2024-10208 | | 2025-03-25 | An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated net… | |
CVE-2024-10207 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the… | |
CVE-2024-10206 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force th… | |
CVE-2024-9103 | Medium | 6.1 | 2025-03-24 | Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issu… |
CVE-2024-55279 | Medium | 6.0 | 2025-03-24 | Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files. |
CVE-2024-8774 | | 2025-03-24 | The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database admini… | |
CVE-2024-8773 | | 2025-03-24 | SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data int… | |
CVE-2024-13124 | Low | 3.5 | 2025-03-24 | The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-10558 | Low | 3.5 | 2025-03-24 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13666 | Medium | 5.3 | 2025-03-22 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all ver… |
CVE-2024-13856 | Medium | 6.4 | 2025-03-22 | The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ… |
CVE-2024-13768 | Medium | 4.3 | 2025-03-22 | The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-13739 | Medium | 6.1 | 2025-03-22 | The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due t… |
CVE-2024-13737 | Medium | 4.3 | 2025-03-22 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on th… |
CVE-2024-53351 | Critical | 9.8 | 2025-03-21 | Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2024-53350 | High | 7.4 | 2025-03-21 | Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2024-53349 | High | 7.4 | 2025-03-21 | Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes co… |
CVE-2024-53348 | High | 7.4 | 2025-03-21 | LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges. |
CVE-2024-57490 | High | 7.7 | 2025-03-21 | Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administra… |
CVE-2024-13903 | Medium | 4.3 | 2025-03-21 | A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime… |
CVE-2024-50053 | Medium | 6.3 | 2025-03-21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in… |
CVE-2024-54564 | Medium | 6.5 | 2025-03-21 | This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, visionOS 1.3. A file received f… |
CVE-2024-54551 | High | 7.5 | 2025-03-21 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3… |
CVE-2024-44305 | High | 7.8 | 2025-03-21 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able to gain root privileges. |
CVE-2024-44199 | High | 7.1 | 2025-03-21 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause unexpected system ter… |
CVE-2024-7598 | Low | 3.1 | 2025-03-20 | A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namesp… |
CVE-2024-57440 | High | 7.5 | 2025-03-20 | D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi |