2024 CVEs (page 25)
Page 25 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58052 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table T… |
CVE-2024-58051 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf() can return a NULL… |
CVE-2024-42844 | High | 8.1 | 2025-03-06 | A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execu… |
CVE-2024-12146 | High | 7.5 | 2025-03-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (New System) allows SQL… |
CVE-2024-13894 | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to path traversal. When an… | |
CVE-2024-13893 | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet ser… | |
CVE-2024-13892 | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. Durin… | |
CVE-2024-12144 | Critical | 9.8 | 2025-03-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (Old System) allows SQL… |
CVE-2024-7872 | High | 7.6 | 2025-03-06 | Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data. This issue affects Extreme… |
CVE-2024-56196 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended t… |
CVE-2024-56195 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3… |
CVE-2024-38311 | Medium | 6.3 | 2025-03-06 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-56202 | Medium | 4.3 | 2025-03-06 | Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10… |
CVE-2024-13902 | Low | 2.4 | 2025-03-06 | A vulnerability, which was classified as problematic, was found in huang-yk student-manage 1.0. This affects an unknown part of the component Edit a Student In… |
CVE-2024-13897 | Medium | 6.5 | 2025-03-06 | The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page funct… |
CVE-2024-13868 | Medium | 6.1 | 2025-03-06 | The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting… |
CVE-2024-57174 | High | 8.1 | 2025-03-05 | A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the default DNS suffix. This allows attackers… |
CVE-2024-51144 | High | 8.8 | 2025-03-05 | Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user&a… |
CVE-2024-48246 | Medium | 5.4 | 2025-03-05 | Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php. |
CVE-2024-31525 | High | 7.2 | 2025-03-05 | Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain com… |
CVE-2024-53458 | High | 7.5 | 2025-03-05 | Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets. |
CVE-2024-11035 | Low | 2.5 | 2025-03-05 | Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive informati… |
CVE-2024-12799 | | 2025-03-05 | Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnera… | |
CVE-2024-13147 | Critical | 9.8 | 2025-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection. Th… |
CVE-2024-12097 | Critical | 9.8 | 2025-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informatics E-Travel allows SQL Injection. Thi… |
CVE-2024-11216 | High | 7.6 | 2025-03-05 | Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allow… |
CVE-2024-13471 | High | 7.5 | 2025-03-05 | The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_f… |
CVE-2024-13423 | Medium | 5.3 | 2025-03-05 | The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plu… |
CVE-2024-12650 | Medium | 5.4 | 2025-03-05 | An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of… |
CVE-2024-12281 | Critical | 9.8 | 2025-03-05 | The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who a… |
CVE-2024-11951 | Critical | 9.8 | 2025-03-05 | The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allo… |
CVE-2024-11153 | Medium | 5.3 | 2025-03-05 | The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensiti… |
CVE-2024-5667 | Medium | 6.4 | 2025-03-05 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1… |
CVE-2024-13839 | Medium | 6.1 | 2025-03-05 | The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr… |
CVE-2024-13815 | Medium | 6.5 | 2025-03-05 | The The Listingo theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.7. This is due to the software al… |
CVE-2024-13811 | Medium | 4.3 | 2025-03-05 | The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-13810 | Medium | 4.3 | 2025-03-05 | The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2024-13809 | Medium | 6.5 | 2025-03-05 | The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3… |
CVE-2024-13787 | Critical | 9.8 | 2025-03-05 | The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization… |
CVE-2024-13780 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2024-13779 | Medium | 6.1 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'index' parameter in all ver… |
CVE-2024-13778 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and incl… |
CVE-2024-13777 | High | 8.1 | 2025-03-05 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.9… |
CVE-2024-13757 | Medium | 6.4 | 2025-03-05 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versio… |
CVE-2024-13747 | Medium | 4.3 | 2025-03-05 | The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_d… |
CVE-2024-13232 | High | 8.8 | 2025-03-05 | The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalati… |
CVE-2024-12815 | Medium | 6.4 | 2025-03-05 | The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions up to, and including… |
CVE-2024-11731 | Medium | 6.4 | 2025-03-05 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versi… |
CVE-2024-8682 | Medium | 5.3 | 2025-03-05 | The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and includin… |
CVE-2024-13866 | Medium | 6.4 | 2025-03-05 | The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input s… |
CVE-2024-13827 | Medium | 6.1 | 2025-03-05 | The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and re… |
CVE-2024-13350 | Medium | 6.4 | 2025-03-05 | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions… |
CVE-2024-0141 | Medium | 6.8 | 2025-03-05 | NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write to an unsupported… |
CVE-2024-0114 | High | 8.1 | 2025-03-05 | NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the… |
CVE-2024-9135 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing p… |
CVE-2024-8000 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in… |
CVE-2024-41147 | High | 7.7 | 2025-03-04 | An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac fil… |
CVE-2024-10930 | High | 7.8 | 2025-03-04 | An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated… |
CVE-2024-50707 | Critical | 10.0 | 2025-03-04 | Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-… |
CVE-2024-50704 | Critical | 10.0 | 2025-03-04 | Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially craf… |
CVE-2024-11957 | | 2025-03-04 | Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attac… | |
CVE-2024-9149 | High | 8.6 | 2025-03-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injecti… |
CVE-2024-50706 | Critical | 9.8 | 2025-03-04 | Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend databa… |
CVE-2024-50705 | High | 7.1 | 2025-03-04 | Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts vi… |
CVE-2024-9618 | Medium | 6.4 | 2025-03-04 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2024-13724 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2024-13682 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2024-58050 | Medium | 6.2 | 2025-03-04 | Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58049 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58048 | Medium | 6.7 | 2025-03-04 | Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58047 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58046 | Medium | 6.2 | 2025-03-04 | Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58045 | High | 8.6 | 2025-03-04 | Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58044 | High | 8.4 | 2025-03-04 | Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58043 | High | 7.3 | 2025-03-04 | Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-48248 | High | 8.6 | 2025-03-04 | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code… |
CVE-2024-47262 | Medium | 5.3 | 2025-03-04 | Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an… |
CVE-2024-47260 | Medium | 6.5 | 2025-03-04 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading… |
CVE-2024-47259 | Low | 3.5 | 2025-03-04 | Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing fo… |
CVE-2024-13685 | Medium | 5.3 | 2025-03-04 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to… |
CVE-2024-13686 | Medium | 4.3 | 2025-03-04 | The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_setti… |
CVE-2024-55064 | Medium | 5.4 | 2025-03-03 | Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the… |
CVE-2024-5888 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51966 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51963 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a… |
CVE-2024-51962 | High | 8.7 | 2025-03-03 | A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |
CVE-2024-51960 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51959 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51958 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51957 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51956 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51954 | High | 8.5 | 2025-03-03 | There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote… |
CVE-2024-51953 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51952 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51951 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51950 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51949 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51948 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51947 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |