2024 CVEs (page 26)
Page 26 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51946 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51945 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51944 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51942 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-10904 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-30154 | Medium | 5.3 | 2025-03-03 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a… |
CVE-2024-53384 | Medium | 5.1 | 2025-03-03 | A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript… |
CVE-2024-51091 | Medium | 5.4 | 2025-03-03 | Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package |
CVE-2024-57240 | Medium | 5.4 | 2025-03-03 | A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execute arbitrary code v… |
CVE-2024-53388 | High | 8.8 | 2025-03-03 | A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element. |
CVE-2024-53387 | High | 8.8 | 2025-03-03 | A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element. |
CVE-2024-45782 | High | 7.8 | 2025-03-03 | A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-prov… |
CVE-2024-45778 | Medium | 4.1 | 2025-03-03 | A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. |
CVE-2024-55570 | Medium | 5.4 | 2025-03-03 | /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote authenticated user… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to versio… |
CVE-2024-43169 | High | 8.8 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the… |
CVE-2024-41771 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-41770 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-8262 | Critical | 9.8 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects… |
CVE-2024-8261 | High | 7.5 | 2025-03-03 | Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. … |
CVE-2024-45780 | Medium | 6.7 | 2025-03-03 | A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation ag… |
CVE-2024-45779 | Medium | 6.0 | 2025-03-03 | An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number… |
CVE-2024-54179 | Medium | 5.4 | 2025-03-03 | IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to… |
CVE-2024-47092 | Critical | 9.8 | 2025-03-03 | Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1 |
CVE-2024-53034 | High | 7.8 | 2025-03-03 | Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset. |
CVE-2024-53033 | High | 7.8 | 2025-03-03 | Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address. |
CVE-2024-53032 | High | 7.8 | 2025-03-03 | Memory corruption may occur in keyboard virtual device due to guest VM interaction. |
CVE-2024-53031 | High | 7.8 | 2025-03-03 | Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine. |
CVE-2024-53030 | High | 7.8 | 2025-03-03 | Memory corruption while processing input message passed from FE driver. |
CVE-2024-53029 | High | 7.8 | 2025-03-03 | Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine. |
CVE-2024-53028 | High | 7.8 | 2025-03-03 | Memory corruption may occur while processing message from frontend during allocation. |
CVE-2024-53027 | High | 7.5 | 2025-03-03 | Transient DOS may occur while processing the country IE. |
CVE-2024-53025 | Medium | 5.5 | 2025-03-03 | Transient DOS can occur while processing UCI command. |
CVE-2024-53024 | High | 7.8 | 2025-03-03 | Memory corruption in display driver while detaching a device. |
CVE-2024-53023 | High | 7.8 | 2025-03-03 | Memory corruption may occur while accessing a variable during extended back to back tests. |
CVE-2024-53022 | High | 7.8 | 2025-03-03 | Memory corruption may occur during communication between primary and guest VM. |
CVE-2024-53014 | High | 7.8 | 2025-03-03 | Memory corruption may occur while validating ports and channels in Audio driver. |
CVE-2024-53012 | High | 7.8 | 2025-03-03 | Memory corruption may occur due to improper input validation in clock device. |
CVE-2024-53011 | High | 7.9 | 2025-03-03 | Information disclosure may occur due to improper permission and access controls to Video Analytics engine. |
CVE-2024-49836 | High | 7.8 | 2025-03-03 | Memory corruption may occur during the synchronization of the camera`s frame processing pipeline. |
CVE-2024-45580 | High | 7.8 | 2025-03-03 | Memory corruption while handling multuple IOCTL calls from userspace for remote invocation. |
CVE-2024-43062 | High | 7.8 | 2025-03-03 | Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization. |
CVE-2024-43061 | High | 7.8 | 2025-03-03 | Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive. |
CVE-2024-43060 | High | 7.8 | 2025-03-03 | Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. |
CVE-2024-43059 | High | 7.8 | 2025-03-03 | Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node. |
CVE-2024-43057 | High | 7.8 | 2025-03-03 | Memory corruption while processing command in Glink linux. |
CVE-2024-43056 | Medium | 5.5 | 2025-03-03 | Transient DOS during hypervisor virtual I/O operation in a virtual machine. |
CVE-2024-43055 | High | 7.8 | 2025-03-03 | Memory corruption while processing camera use case IOCTL call. |
CVE-2024-43051 | Medium | 5.5 | 2025-03-03 | Information disclosure while deriving keys for a session for any Widevine use case. |
CVE-2024-38426 | Medium | 5.4 | 2025-03-03 | While processing the authentication message in UE, improper authentication may lead to information disclosure. |
CVE-2024-24778 | Medium | 6.5 | 2025-03-03 | Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affec… |
CVE-2024-10925 | Medium | 5.3 | 2025-03-03 | A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Secur… |
CVE-2024-8186 | Medium | 5.4 | 2025-03-03 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inje… |
CVE-2024-53386 | Medium | 4.9 | 2025-03-03 | Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because doc… |
CVE-2024-53382 | Medium | 4.9 | 2025-03-03 | Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript)… |
CVE-2024-36353 | Medium | 6.5 | 2025-03-02 | Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss… |
CVE-2024-55907 | Low | 2.0 | 2025-03-02 | IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique… |
CVE-2024-41778 | Medium | 5.3 | 2025-03-01 | IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to com… |
CVE-2024-13833 | High | 7.2 | 2025-03-01 | The Album Gallery – WordPress Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.3 via deserializatio… |
CVE-2024-13546 | Medium | 4.3 | 2025-03-01 | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'get_image_descript… |
CVE-2024-13910 | High | 7.2 | 2025-03-01 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2024-13697 | Medium | 4.8 | 2025-03-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery… |
CVE-2024-13611 | High | 7.5 | 2025-03-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Expos… |
CVE-2024-13911 | High | 7.2 | 2025-03-01 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-13806 | Medium | 6.5 | 2025-03-01 | The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the softwa… |
CVE-2024-12544 | High | 8.8 | 2025-03-01 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2024-13373 | High | 8.1 | 2025-03-01 | The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due… |
CVE-2024-12824 | Critical | 9.8 | 2025-03-01 | The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6… |
CVE-2024-13901 | Medium | 4.4 | 2025-03-01 | The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting… |
CVE-2024-9217 | Medium | 6.1 | 2025-03-01 | The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate… |
CVE-2024-9212 | Medium | 6.1 | 2025-03-01 | The SKU Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esca… |
CVE-2024-13750 | Medium | 6.5 | 2025-03-01 | The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to… |
CVE-2024-13746 | Medium | 6.5 | 2025-03-01 | The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability check… |
CVE-2024-13568 | High | 7.5 | 2025-03-01 | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2024-13559 | Medium | 6.4 | 2025-03-01 | The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions… |
CVE-2024-13518 | Medium | 4.3 | 2025-03-01 | The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing o… |
CVE-2024-13358 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-1509 | Critical | 9.1 | 2025-02-28 | Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the ser… |
CVE-2024-54175 | Medium | 5.5 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditi… |
CVE-2024-44754 | Medium | 6.8 | 2025-02-28 | Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware int… |
CVE-2024-10860 | Medium | 4.3 | 2025-02-28 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on t… |
CVE-2024-9195 | High | 8.8 | 2025-02-28 | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing… |
CVE-2024-9193 | Critical | 9.8 | 2025-02-28 | The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision… |
CVE-2024-9019 | Medium | 6.4 | 2025-02-28 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortco… |
CVE-2024-8425 | Critical | 9.8 | 2025-02-28 | The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_previe… |
CVE-2024-8420 | Critical | 9.8 | 2025-02-28 | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user… |
CVE-2024-13851 | Medium | 5.5 | 2025-02-28 | The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input s… |
CVE-2024-13832 | Medium | 4.3 | 2025-02-28 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elemento… |
CVE-2024-13831 | High | 7.2 | 2025-02-28 | The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untruste… |
CVE-2024-13716 | Medium | 4.3 | 2025-02-28 | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback()… |
CVE-2024-13638 | Medium | 5.9 | 2025-02-28 | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the… |
CVE-2024-13469 | Medium | 6.4 | 2025-02-28 | The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1… |
CVE-2024-12820 | Medium | 6.4 | 2025-02-28 | The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and includi… |
CVE-2024-13796 | Medium | 5.3 | 2025-02-28 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3… |
CVE-2024-56340 | Medium | 6.5 | 2025-02-28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting… |
CVE-2024-54173 | Medium | 4.7 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace i… |
CVE-2024-12811 | High | 8.8 | 2025-02-28 | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for a… |
CVE-2024-37567 | Critical | 9.1 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. |
CVE-2024-37566 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. |
CVE-2024-36047 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation. |