2024 CVEs (page 23)
Page 23 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7296 | Low | 2.7 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user wit… |
CVE-2024-13891 | High | 7.1 | 2025-03-13 | The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13885 | High | 7.1 | 2025-03-13 | The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-13884 | High | 7.1 | 2025-03-13 | The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-13054 | Medium | 6.5 | 2025-03-13 | An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnera… |
CVE-2024-12380 | Medium | 4.4 | 2025-03-13 | An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions st… |
CVE-2024-13887 | Medium | 5.3 | 2025-03-13 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions u… |
CVE-2024-13703 | Medium | 4.3 | 2025-03-13 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_aja… |
CVE-2024-26290 | | 2025-03-12 | Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Dir… | |
CVE-2024-34398 | Medium | 4.2 | 2025-03-12 | An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers. |
CVE-2024-27763 | Medium | 5.3 | 2025-03-12 | XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a cr… |
CVE-2024-52362 | Medium | 4.3 | 2025-03-12 | IBM App Connect Enterprise Certified Container 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3… |
CVE-2024-10838 | Critical | 9.1 | 2025-03-12 | An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers… |
CVE-2024-13872 | High | 7.5 | 2025-03-12 | Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and… |
CVE-2024-13871 | High | 8.8 | 2025-03-12 | A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw al… |
CVE-2024-13870 | Medium | 5.7 | 2025-03-12 | An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgra… |
CVE-2024-58089 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When runni… |
CVE-2024-58088 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Pr… |
CVE-2024-13446 | Critical | 9.8 | 2025-03-12 | The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the pl… |
CVE-2024-13430 | Medium | 4.3 | 2025-03-12 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1… |
CVE-2024-58087 | Critical | 9.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference coun… |
CVE-2024-13838 | Medium | 5.5 | 2025-03-12 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in a… |
CVE-2024-12589 | Medium | 6.4 | 2025-03-12 | The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdow… |
CVE-2024-13498 | Medium | 5.3 | 2025-03-12 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-9157 | High | 7.8 | 2025-03-11 | ** UNSUPPORTED WHEN ASSIGNED ** A privilege escalation vulnerability in CxUIUSvc64.exe and CxUIUSvc32.exe of Synaptics audio drivers allows a local authorize… |
CVE-2024-56338 | Medium | 4.8 | 2025-03-11 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2024-55597 | Medium | 5.5 | 2025-03-11 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute u… |
CVE-2024-55592 | Low | 3.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 a… |
CVE-2024-55590 | High | 8.8 | 2025-03-11 | Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiIsolator version… |
CVE-2024-54026 | Medium | 4.3 | 2025-03-11 | An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all vers… |
CVE-2024-54018 | High | 7.2 | 2025-03-11 | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker t… |
CVE-2024-52961 | High | 8.8 | 2025-03-11 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 th… |
CVE-2024-52960 | Medium | 4.3 | 2025-03-11 | A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows a… |
CVE-2024-51322 | Medium | 5.4 | 2025-03-11 | Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /j… |
CVE-2024-51321 | High | 7.6 | 2025-03-11 | In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after t… |
CVE-2024-51320 | Medium | 5.4 | 2025-03-11 | Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsa… |
CVE-2024-51319 | High | 7.3 | 2025-03-11 | A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by… |
CVE-2024-46663 | Medium | 6.7 | 2025-03-11 | A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute… |
CVE-2024-45328 | High | 7.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI comman… |
CVE-2024-45324 | High | 7.2 | 2025-03-11 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through… |
CVE-2024-33501 | Medium | 4.2 | 2025-03-11 | Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through… |
CVE-2024-32123 | Medium | 6.7 | 2025-03-11 | Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 thro… |
CVE-2024-54085 | Critical | 9.8 | 2025-03-11 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitatio… |
CVE-2024-54084 | High | 7.5 | 2025-03-11 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-56336 | Critical | 9.8 | 2025-03-11 | A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The… |
CVE-2024-56182 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V… |
CVE-2024-56181 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V2… |
CVE-2024-52285 | Medium | 5.3 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < V6.4.8). Affected de… |
CVE-2024-28607 | Low | 2.9 | 2025-03-11 | The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via… |
CVE-2024-58102 | Medium | 5.7 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied querie… |
CVE-2024-13228 | Medium | 4.3 | 2025-03-11 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via th… |
CVE-2024-13864 | High | 7.1 | 2025-03-11 | The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-13862 | High | 7.1 | 2025-03-11 | The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputtin… |
CVE-2024-13853 | Medium | 6.1 | 2025-03-11 | The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13836 | High | 7.1 | 2025-03-11 | The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-13615 | Low | 3.5 | 2025-03-11 | The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape… |
CVE-2024-13580 | Medium | 4.3 | 2025-03-11 | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2024-13574 | High | 7.1 | 2025-03-11 | The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-13413 | Medium | 6.1 | 2025-03-11 | The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due t… |
CVE-2024-13436 | Medium | 6.1 | 2025-03-11 | The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or inco… |
CVE-2024-12010 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier co… |
CVE-2024-12009 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow… |
CVE-2024-11253 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(… |
CVE-2024-49823 | Medium | 6.5 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM)… |
CVE-2024-41760 | Low | 3.7 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA… |
CVE-2024-22340 | Medium | 6.5 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signa… |
CVE-2024-56192 | High | 7.8 | 2025-03-10 | In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2024-56191 | High | 8.4 | 2025-03-10 | In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no add… |
CVE-2024-56188 | Medium | 5.1 | 2025-03-10 | there is a possible way to crash the modem due to a missing null check. This could lead to remote denial of service with no additional execution privileges nee… |
CVE-2024-56187 | Medium | 6.6 | 2025-03-10 | In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. This could lead to local informa… |
CVE-2024-56186 | Medium | 5.1 | 2025-03-10 | In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclos… |
CVE-2024-56185 | Medium | 5.1 | 2025-03-10 | In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lea… |
CVE-2024-56184 | Medium | 5.1 | 2025-03-10 | In static long dev_send of tipc_dev_ql, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosur… |
CVE-2024-54560 | Medium | 5.5 | 2025-03-10 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, watchOS 11. A malicious app may be ab… |
CVE-2024-54558 | Low | 2.8 | 2025-03-10 | A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be abl… |
CVE-2024-54546 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause unexpected system termination or co… |
CVE-2024-54473 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive… |
CVE-2024-54469 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2… |
CVE-2024-54467 | Medium | 6.5 | 2025-03-10 | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visi… |
CVE-2024-54463 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user conse… |
CVE-2024-44227 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected sy… |
CVE-2024-44192 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Proces… |
CVE-2024-44179 | Low | 2.4 | 2025-03-10 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoi… |
CVE-2024-55199 | Medium | 5.4 | 2025-03-10 | A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file t… |
CVE-2024-53307 | Medium | 5.4 | 2025-03-10 | A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary code in the contex… |
CVE-2024-52812 | Medium | 5.4 | 2025-03-10 | LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kui… |
CVE-2024-52905 | Low | 2.7 | 2025-03-10 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged… |
CVE-2024-47109 | Medium | 5.3 | 2025-03-10 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in furthe… |
CVE-2024-12604 | Medium | 6.5 | 2025-03-10 | Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Tech… |
CVE-2024-57492 | Medium | 5.5 | 2025-03-10 | An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton. |
CVE-2024-13919 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in… |
CVE-2024-13918 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters i… |
CVE-2024-11638 | High | 8.8 | 2025-03-10 | The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated atta… |
CVE-2024-43107 | High | 7.2 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent t… |
CVE-2024-41724 | High | 8.7 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affe… |
CVE-2024-13924 | Medium | 5.3 | 2025-03-08 | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'h… |
CVE-2024-10326 | Medium | 4.3 | 2025-03-08 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options an… |
CVE-2024-13675 | Medium | 6.4 | 2025-03-08 | The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Blo… |
CVE-2024-13649 | Medium | 6.4 | 2025-03-08 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to… |
CVE-2024-11640 | High | 8.8 | 2025-03-08 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This… |