2024 CVEs (page 22)
Page 22 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45644 | Medium | 4.7 | 2025-03-19 | IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's envir… |
CVE-2024-13933 | High | 8.8 | 2025-03-19 | The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2024-13442 | Critical | 9.8 | 2025-03-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is… |
CVE-2024-12920 | High | 8.8 | 2025-03-19 | The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to… |
CVE-2024-13790 | Critical | 9.8 | 2025-03-19 | The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3… |
CVE-2024-12137 | High | 7.6 | 2025-03-19 | Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: befor… |
CVE-2024-12136 | Medium | 6.9 | 2025-03-19 | Missing Critical Step in Authentication vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Authentication Bypass. This issue affects ANKA JPD-00028: b… |
CVE-2024-13412 | High | 7.5 | 2025-03-19 | The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versi… |
CVE-2024-13410 | Critical | 9.8 | 2025-03-19 | The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to… |
CVE-2024-50631 | High | 7.5 | 2025-03-19 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before… |
CVE-2024-50630 | High | 7.5 | 2025-03-19 | Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3… |
CVE-2024-50629 | Medium | 5.3 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager… |
CVE-2024-12922 | Critical | 9.8 | 2025-03-19 | The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check withi… |
CVE-2024-12295 | High | 8.8 | 2025-03-19 | The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0. This… |
CVE-2024-11131 | Critical | 9.8 | 2025-03-19 | A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. T… |
CVE-2024-10442 | Critical | 10.0 | 2025-03-19 | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified… |
CVE-2024-10445 | Medium | 4.3 | 2025-03-19 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DS… |
CVE-2024-10444 | High | 7.5 | 2025-03-19 | Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3… |
CVE-2024-10441 | Critical | 9.8 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Man… |
CVE-2024-57151 | Medium | 6.8 | 2025-03-18 | SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveA… |
CVE-2024-12563 | High | 8.8 | 2025-03-18 | The s2Member Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 250214 via the 'template' attribute. This mak… |
CVE-2024-56347 | Critical | 9.6 | 2025-03-18 | IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. |
CVE-2024-56346 | Critical | 10.0 | 2025-03-18 | IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. |
CVE-2024-57170 | Medium | 6.5 | 2025-03-18 | SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to spe… |
CVE-2024-57169 | Critical | 9.8 | 2025-03-18 | A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass uplo… |
CVE-2024-49822 | Medium | 4.1 | 2025-03-18 | IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reque… |
CVE-2024-44314 | Medium | 6.5 | 2025-03-18 | TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. Th… |
CVE-2024-44313 | High | 8.1 | 2025-03-18 | TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and… |
CVE-2024-8997 | Critical | 9.8 | 2025-03-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection… |
CVE-2024-21760 | High | 8.4 | 2025-03-18 | An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 al… |
CVE-2024-41975 | Medium | 5.3 | 2025-03-18 | An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs. |
CVE-2024-23943 | Critical | 9.1 | 2025-03-18 | An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availabili… |
CVE-2024-23942 | High | 7.1 | 2025-03-18 | A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prev… |
CVE-2024-40635 | Medium | 4.6 | 2025-03-17 | containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User… |
CVE-2024-54565 | Medium | 6.2 | 2025-03-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data. |
CVE-2024-54559 | Medium | 5.5 | 2025-03-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data. |
CVE-2024-54525 | High | 8.8 | 2025-03-17 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS… |
CVE-2024-44276 | High | 7.3 | 2025-03-17 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2. A user in a privileged netw… |
CVE-2024-8510 | Medium | 5.3 | 2025-03-17 | N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerab… |
CVE-2024-44866 | Medium | 6.8 | 2025-03-17 | A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS)… |
CVE-2024-49561 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged… |
CVE-2024-49559 | High | 8.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A low privileged attack… |
CVE-2024-48831 | High | 8.4 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker with local access could… |
CVE-2024-48828 | Medium | 5.5 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Management vulnerability. A low privileged… |
CVE-2024-48017 | Medium | 6.5 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48015 | Medium | 6.7 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48830 | High | 7.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command… |
CVE-2024-48013 | High | 8.8 | 2025-03-17 | Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low pri… |
CVE-2024-9055 | Medium | 4.2 | 2025-03-17 | The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract sec… |
CVE-2024-54027 | High | 8.2 | 2025-03-17 | A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, versio… |
CVE-2024-12992 | Critical | 9.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 7… |
CVE-2024-12971 | High | 8.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 |
CVE-2024-13602 | Medium | 4.8 | 2025-03-16 | The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-13126 | Medium | 4.6 | 2025-03-16 | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of f… |
CVE-2024-58103 | Medium | 5.8 | 2025-03-16 | Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt. |
CVE-2024-13497 | High | 7.2 | 2025-03-15 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attac… |
CVE-2024-12336 | Medium | 6.5 | 2025-03-15 | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2024-54449 | High | 8.8 | 2025-03-14 | The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with contro… |
CVE-2024-54448 | High | 7.2 | 2025-03-14 | The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with admin… |
CVE-2024-54447 | | 2025-03-14 | Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacke… | |
CVE-2024-54446 | | 2025-03-14 | Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the att… | |
CVE-2024-54445 | | 2025-03-14 | Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can… | |
CVE-2024-29409 | Medium | 5.5 | 2025-03-14 | File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. |
CVE-2024-12245 | | 2025-03-14 | Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker ca… | |
CVE-2024-12020 | Medium | 6.1 | 2025-03-14 | There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into… |
CVE-2024-12019 | | 2025-03-14 | The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyin… | |
CVE-2024-55594 | Medium | 5.6 | 2025-03-14 | An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7… |
CVE-2024-40585 | Medium | 6.5 | 2025-03-14 | An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below… |
CVE-2024-47573 | Medium | 6.5 | 2025-03-14 | An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, version 7.1.1 and below… |
CVE-2024-46662 | High | 8.8 | 2025-03-14 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud… |
CVE-2024-45643 | Medium | 5.9 | 2025-03-14 | IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information. |
CVE-2024-45638 | Medium | 4.1 | 2025-03-14 | IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user. |
CVE-2024-40590 | Medium | 4.8 | 2025-03-14 | An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and b… |
CVE-2024-13773 | High | 7.3 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2024-13772 | Medium | 5.6 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-13771 | Critical | 9.8 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-12810 | High | 8.8 | 2025-03-14 | The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing… |
CVE-2024-26006 | High | 7.5 | 2025-03-14 | An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0… |
CVE-2024-8176 | High | 7.5 | 2025-03-14 | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML docume… |
CVE-2024-13407 | Medium | 4.3 | 2025-03-14 | The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient… |
CVE-2024-13321 | High | 7.5 | 2025-03-14 | The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0.0 due to insuffici… |
CVE-2024-13824 | Critical | 9.8 | 2025-03-14 | The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deseri… |
CVE-2024-13913 | High | 8.8 | 2025-03-14 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1… |
CVE-2024-13376 | High | 8.8 | 2025-03-14 | The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check o… |
CVE-2024-11286 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly ve… |
CVE-2024-11285 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the pl… |
CVE-2024-11284 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the pl… |
CVE-2024-11283 | High | 7.5 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_c… |
CVE-2024-55549 | High | 7.8 | 2025-03-14 | xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. |
CVE-2024-55060 | Medium | 6.1 | 2025-03-13 | A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-30143 | Medium | 4.3 | 2025-03-13 | HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the… |
CVE-2024-9042 | Medium | 5.9 | 2025-03-13 | This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below. |
CVE-2024-53406 | High | 8.8 | 2025-03-13 | Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key… |
CVE-2024-57062 | Medium | 6.7 | 2025-03-13 | An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive information via the session handling compon… |
CVE-2024-55198 | Medium | 5.3 | 2025-03-13 | User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker… |
CVE-2024-57348 | Medium | 6.1 | 2025-03-13 | Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted payload to the host… |
CVE-2024-28803 | Medium | 6.1 | 2025-03-13 | Cross-site scripting (XSS) vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script o… |
CVE-2024-22880 | Medium | 4.7 | 2025-03-13 | Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary code via a crafted script to the webch… |
CVE-2024-10942 | High | 7.5 | 2025-03-13 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserializatio… |
CVE-2024-8402 | Low | 3.7 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions start… |