2024 CVEs (page 24)
Page 24 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13359 | High | 8.1 | 2025-03-08 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_produ… |
CVE-2024-13882 | High | 8.8 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads d… |
CVE-2024-13816 | Medium | 5.4 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, mod… |
CVE-2024-10321 | Medium | 4.3 | 2025-03-08 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5… |
CVE-2024-13908 | High | 7.2 | 2025-03-08 | The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all… |
CVE-2024-11087 | High | 8.1 | 2025-03-08 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all vers… |
CVE-2024-13844 | Medium | 4.9 | 2025-03-08 | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insuff… |
CVE-2024-13826 | Medium | 5.4 | 2025-03-08 | The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-13825 | Medium | 6.1 | 2025-03-08 | The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-12119 | Medium | 6.4 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2024-12114 | Medium | 4.3 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference i… |
CVE-2024-13640 | Medium | 5.9 | 2025-03-08 | The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5… |
CVE-2024-13895 | Medium | 4.3 | 2025-03-08 | The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the s… |
CVE-2024-13890 | High | 7.2 | 2025-03-08 | The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to b… |
CVE-2024-13835 | High | 7.2 | 2025-03-08 | The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the… |
CVE-2024-13774 | Medium | 6.1 | 2025-03-08 | The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… |
CVE-2024-12460 | Medium | 6.4 | 2025-03-08 | The Years Since – Timeless Texts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'years-since' shortcode in all versions up… |
CVE-2024-42733 | Critical | 9.8 | 2025-03-07 | An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input |
CVE-2024-53700 | High | 7.2 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator… |
CVE-2024-53699 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53698 | Medium | 4.9 | 2025-03-07 | A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers wh… |
CVE-2024-53697 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53696 | Medium | 4.9 | 2025-03-07 | A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2024-53695 | Critical | 9.1 | 2025-03-07 | A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify me… |
CVE-2024-53694 | | 2025-03-07 | A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could a… | |
CVE-2024-53693 | High | 7.1 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-53692 | Medium | 4.7 | 2025-03-07 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50405 | Medium | 5.5 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-50394 | High | 8.8 | 2025-03-07 | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromi… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2024-48864 | Critical | 9.1 | 2025-03-07 | A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem… |
CVE-2024-38638 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-13086 | Medium | 5.3 | 2025-03-07 | An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to comprom… |
CVE-2024-12975 | | 2025-03-07 | A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet over the SPI interface. | |
CVE-2024-12634 | Medium | 6.1 | 2025-03-07 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2024-9458 | Medium | 4.8 | 2025-03-07 | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-13857 | Medium | 5.5 | 2025-03-07 | The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10… |
CVE-2024-13805 | Medium | 6.4 | 2025-03-07 | The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via S… |
CVE-2024-13668 | High | 7.1 | 2025-03-07 | The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2024-13635 | Medium | 4.3 | 2025-03-07 | The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. T… |
CVE-2024-13552 | Medium | 4.3 | 2025-03-07 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2024-9658 | High | 8.8 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including… |
CVE-2024-13904 | Medium | 5.3 | 2025-03-07 | The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.6 via the 'ho… |
CVE-2024-13781 | Medium | 6.5 | 2025-03-07 | The Hero Maps Premium plugin for WordPress is vulnerable to SQL Injection via several AJAX actions in all versions up to, and including, 2.3.9 due to insuffici… |
CVE-2024-13431 | Medium | 6.1 | 2025-03-07 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the acc… |
CVE-2024-12876 | Critical | 9.8 | 2025-03-07 | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includin… |
CVE-2024-12611 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to… |
CVE-2024-12610 | Medium | 5.3 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_re… |
CVE-2024-12609 | Medium | 6.5 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and includ… |
CVE-2024-12607 | Medium | 6.5 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_event_task' AJAX act… |
CVE-2024-12036 | High | 7.5 | 2025-03-07 | The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() functio… |
CVE-2024-12035 | High | 8.8 | 2025-03-07 | The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cs_widget_file_delete() function… |
CVE-2024-10804 | High | 7.5 | 2025-03-07 | The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 10.0 v… |
CVE-2024-13906 | High | 7.2 | 2025-03-07 | The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2024-12837 | High | 7.8 | 2025-03-07 | Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. |
CVE-2024-12576 | Medium | 5.5 | 2025-03-07 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics out… |
CVE-2024-13655 | High | 8.1 | 2025-03-07 | The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2024-13320 | High | 7.5 | 2025-03-07 | The CURCY - WooCommerce Multi Currency - Currency Switcher plugin for WordPress is vulnerable to SQL Injection via the 'wc_filter_price_meta[where]' parameter… |
CVE-2024-12809 | Medium | 6.4 | 2025-03-07 | The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions up to, and includin… |
CVE-2024-13526 | Medium | 4.3 | 2025-03-07 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on… |
CVE-2024-57972 | Medium | 6.5 | 2025-03-06 | The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1… |
CVE-2024-50600 | High | 7.5 | 2025-03-06 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boun… |
CVE-2024-52924 | High | 7.5 | 2025-03-06 | An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380… |
CVE-2024-52923 | High | 7.5 | 2025-03-06 | An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380… |
CVE-2024-58086 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active performance monitor (… |
CVE-2024-58085 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: tomoyo: don't emit warning in tomoyo_write_control() syzbot is reporting too large alloca… |
CVE-2024-58084 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Commit 2e49551… |
CVE-2024-58083 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the targ… |
CVE-2024-58082 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: Fix an error check in npcm_video_ece_init() When function of_find_device_… |
CVE-2024-58081 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: mmp2: call pm_genpd_init() only after genpd.name is set Setting the genpd's struct d… |
CVE-2024-58080 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-sm6350: Add missing parent_map for a clock If a clk_rcg2 has a parent… |
CVE-2024-58079 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device… |
CVE-2024-58078 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors misc_minor_alloc wa… |
CVE-2024-58077 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: l… |
CVE-2024-58076 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-sm6350: Add missing parent_map for two clocks If a clk_rcg2 has a parent… |
CVE-2024-51476 | High | 7.5 | 2025-03-06 | IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2024-12742 | High | 7.8 | 2025-03-06 | A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation… |
CVE-2024-58075 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - do not transfer req when tegra init fails The tegra_cmac_init or tegra_sh… |
CVE-2024-58074 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Grab intel_display from the encoder to avoid potential oopsies Grab the intel_d… |
CVE-2024-58073 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check dpu_plane_atomic_print_state() for valid sspp Similar to the r_pipe ss… |
CVE-2024-58072 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update heade… |
CVE-2024-58071 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a devic… |
CVE-2024-58070 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, kmalloc(GFP… |
CVE-2024-58069 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface support… |
CVE-2024-58068 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls de… |
CVE-2024-58067 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-mpmu: Fix a NULL vs IS_ERR() check The devm_kzalloc() function returns… |
CVE-2024-58066 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check The devm_kzalloc() function doesn't… |
CVE-2024-58065 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check The devm_kzalloc() function returns NU… |
CVE-2024-58064 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap(… |
CVE-2024-58063 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitialize at re… |
CVE-2024-58062 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference When iterating over the links of a vif… |
CVE-2024-58061 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls this is a… |
CVE-2024-58060 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing … |
CVE-2024-58059 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock during uvc_probe If uvc_probe() fails, it can end up callin… |
CVE-2024-58058 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache will free all znode i… |
CVE-2024-58057 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUND`, its wo… |
CVE-2024-58056 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix ida_free call while not allocated In the rproc_alloc() function, on… |
CVE-2024-58055 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: Don't free command immediately Don't prematurely free the command. Wa… |
CVE-2024-58054 | High | 7.1 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: staging: media: max96712: fix kernel oops when removing module The following kernel oops… |
CVE-2024-58053 | High | 7.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connection abort t… |