2024 CVEs (page 23)
Page 23 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52960 | Medium | 4.3 | 2025-03-11 | A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows a… |
CVE-2024-51322 | Medium | 5.4 | 2025-03-11 | Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /j… |
CVE-2024-51321 | High | 7.6 | 2025-03-11 | In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after t… |
CVE-2024-51320 | Medium | 5.4 | 2025-03-11 | Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsa… |
CVE-2024-51319 | High | 7.3 | 2025-03-11 | A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by… |
CVE-2024-46663 | Medium | 6.7 | 2025-03-11 | A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute… |
CVE-2024-45328 | High | 7.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI comman… |
CVE-2024-45324 | High | 7.2 | 2025-03-11 | A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through… |
CVE-2024-33501 | Medium | 4.2 | 2025-03-11 | Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through… |
CVE-2024-32123 | Medium | 6.7 | 2025-03-11 | Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 thro… |
CVE-2024-54085 | Critical | 9.8 | 2025-03-11 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitatio… |
CVE-2024-54084 | High | 7.5 | 2025-03-11 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-56336 | Critical | 9.8 | 2025-03-11 | A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The… |
CVE-2024-56182 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V… |
CVE-2024-56181 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V2… |
CVE-2024-52285 | Medium | 5.3 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < V6.4.8). Affected de… |
CVE-2024-28607 | Low | 2.9 | 2025-03-11 | The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via… |
CVE-2024-58102 | Medium | 5.7 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied querie… |
CVE-2024-13228 | Medium | 4.3 | 2025-03-11 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via th… |
CVE-2024-13864 | High | 7.1 | 2025-03-11 | The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-13862 | High | 7.1 | 2025-03-11 | The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputtin… |
CVE-2024-13853 | Medium | 6.1 | 2025-03-11 | The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13836 | High | 7.1 | 2025-03-11 | The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-13615 | Low | 3.5 | 2025-03-11 | The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape… |
CVE-2024-13580 | Medium | 4.3 | 2025-03-11 | The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2024-13574 | High | 7.1 | 2025-03-11 | The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-13413 | Medium | 6.1 | 2025-03-11 | The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due t… |
CVE-2024-13436 | Medium | 6.1 | 2025-03-11 | The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or inco… |
CVE-2024-12010 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier co… |
CVE-2024-12009 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow… |
CVE-2024-11253 | High | 7.2 | 2025-03-11 | A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(… |
CVE-2024-49823 | Medium | 6.5 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM)… |
CVE-2024-41760 | Low | 3.7 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA… |
CVE-2024-22340 | Medium | 6.5 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signa… |
CVE-2024-56192 | High | 7.8 | 2025-03-10 | In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2024-56191 | High | 8.4 | 2025-03-10 | In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no add… |
CVE-2024-56188 | Medium | 5.1 | 2025-03-10 | there is a possible way to crash the modem due to a missing null check. This could lead to remote denial of service with no additional execution privileges nee… |
CVE-2024-56187 | Medium | 6.6 | 2025-03-10 | In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. This could lead to local informa… |
CVE-2024-56186 | Medium | 5.1 | 2025-03-10 | In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclos… |
CVE-2024-56185 | Medium | 5.1 | 2025-03-10 | In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lea… |
CVE-2024-56184 | Medium | 5.1 | 2025-03-10 | In static long dev_send of tipc_dev_ql, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosur… |
CVE-2024-54560 | Medium | 5.5 | 2025-03-10 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, watchOS 11. A malicious app may be ab… |
CVE-2024-54558 | Low | 2.8 | 2025-03-10 | A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be abl… |
CVE-2024-54546 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause unexpected system termination or co… |
CVE-2024-54473 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive… |
CVE-2024-54469 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2… |
CVE-2024-54467 | Medium | 6.5 | 2025-03-10 | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visi… |
CVE-2024-54463 | Medium | 5.5 | 2025-03-10 | This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user conse… |
CVE-2024-44227 | High | 7.5 | 2025-03-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected sy… |
CVE-2024-44192 | Medium | 5.5 | 2025-03-10 | The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Proces… |
CVE-2024-44179 | Low | 2.4 | 2025-03-10 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoi… |
CVE-2024-55199 | Medium | 5.4 | 2025-03-10 | A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file t… |
CVE-2024-53307 | Medium | 5.4 | 2025-03-10 | A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary code in the contex… |
CVE-2024-52812 | Medium | 5.4 | 2025-03-10 | LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kui… |
CVE-2024-52905 | Low | 2.7 | 2025-03-10 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged… |
CVE-2024-47109 | Medium | 5.3 | 2025-03-10 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in furthe… |
CVE-2024-12604 | Medium | 6.5 | 2025-03-10 | Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Tech… |
CVE-2024-57492 | Medium | 5.5 | 2025-03-10 | An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton. |
CVE-2024-13919 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in… |
CVE-2024-13918 | High | 8.0 | 2025-03-10 | The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters i… |
CVE-2024-11638 | High | 8.8 | 2025-03-10 | The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated atta… |
CVE-2024-43107 | High | 7.2 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent t… |
CVE-2024-41724 | High | 8.7 | 2025-03-10 | Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affe… |
CVE-2024-13924 | Medium | 5.3 | 2025-03-08 | The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'h… |
CVE-2024-10326 | Medium | 4.3 | 2025-03-08 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options an… |
CVE-2024-13675 | Medium | 6.4 | 2025-03-08 | The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Blo… |
CVE-2024-13649 | Medium | 6.4 | 2025-03-08 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to… |
CVE-2024-11640 | High | 8.8 | 2025-03-08 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This… |
CVE-2024-13359 | High | 8.1 | 2025-03-08 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_produ… |
CVE-2024-13882 | High | 8.8 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads d… |
CVE-2024-13816 | Medium | 5.4 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, mod… |
CVE-2024-10321 | Medium | 4.3 | 2025-03-08 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5… |
CVE-2024-13908 | High | 7.2 | 2025-03-08 | The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all… |
CVE-2024-11087 | High | 8.1 | 2025-03-08 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all vers… |
CVE-2024-13844 | Medium | 4.9 | 2025-03-08 | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insuff… |
CVE-2024-13826 | Medium | 5.4 | 2025-03-08 | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-13825 | Medium | 6.1 | 2025-03-08 | The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-12119 | Medium | 6.4 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2024-12114 | Medium | 4.3 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference i… |
CVE-2024-13640 | Medium | 5.9 | 2025-03-08 | The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5… |
CVE-2024-13895 | Medium | 4.3 | 2025-03-08 | The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the s… |
CVE-2024-13890 | High | 7.2 | 2025-03-08 | The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to b… |
CVE-2024-13835 | High | 7.2 | 2025-03-08 | The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the… |
CVE-2024-13774 | Medium | 6.1 | 2025-03-08 | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… |
CVE-2024-12460 | Medium | 6.4 | 2025-03-08 | The Years Since – Timeless Texts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'years-since' shortcode in all versions up… |
CVE-2024-42733 | Critical | 9.8 | 2025-03-07 | An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input |
CVE-2024-53700 | High | 7.2 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator… |
CVE-2024-53699 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53698 | Medium | 4.9 | 2025-03-07 | A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers wh… |
CVE-2024-53697 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53696 | Medium | 4.9 | 2025-03-07 | A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2024-53695 | Critical | 9.1 | 2025-03-07 | A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify me… |
CVE-2024-53694 | | 2025-03-07 | A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could a… | |
CVE-2024-53693 | High | 7.1 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-53692 | Medium | 4.7 | 2025-03-07 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50405 | Medium | 5.5 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-50394 | High | 8.8 | 2025-03-07 | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromi… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2024-48864 | Critical | 9.1 | 2025-03-07 | A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem… |
CVE-2024-38638 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |