2024 CVEs (page 26)
Page 26 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53025 | Medium | 5.5 | 2025-03-03 | Transient DOS can occur while processing UCI command. |
CVE-2024-53024 | High | 7.8 | 2025-03-03 | Memory corruption in display driver while detaching a device. |
CVE-2024-53023 | High | 7.8 | 2025-03-03 | Memory corruption may occur while accessing a variable during extended back to back tests. |
CVE-2024-53022 | High | 7.8 | 2025-03-03 | Memory corruption may occur during communication between primary and guest VM. |
CVE-2024-53014 | High | 7.8 | 2025-03-03 | Memory corruption may occur while validating ports and channels in Audio driver. |
CVE-2024-53012 | High | 7.8 | 2025-03-03 | Memory corruption may occur due to improper input validation in clock device. |
CVE-2024-53011 | High | 7.9 | 2025-03-03 | Information disclosure may occur due to improper permission and access controls to Video Analytics engine. |
CVE-2024-49836 | High | 7.8 | 2025-03-03 | Memory corruption may occur during the synchronization of the camera`s frame processing pipeline. |
CVE-2024-45580 | High | 7.8 | 2025-03-03 | Memory corruption while handling multuple IOCTL calls from userspace for remote invocation. |
CVE-2024-43062 | High | 7.8 | 2025-03-03 | Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization. |
CVE-2024-43061 | High | 7.8 | 2025-03-03 | Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive. |
CVE-2024-43060 | High | 7.8 | 2025-03-03 | Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP. |
CVE-2024-43059 | High | 7.8 | 2025-03-03 | Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node. |
CVE-2024-43057 | High | 7.8 | 2025-03-03 | Memory corruption while processing command in Glink linux. |
CVE-2024-43056 | Medium | 5.5 | 2025-03-03 | Transient DOS during hypervisor virtual I/O operation in a virtual machine. |
CVE-2024-43055 | High | 7.8 | 2025-03-03 | Memory corruption while processing camera use case IOCTL call. |
CVE-2024-43051 | Medium | 5.5 | 2025-03-03 | Information disclosure while deriving keys for a session for any Widevine use case. |
CVE-2024-38426 | Medium | 5.4 | 2025-03-03 | While processing the authentication message in UE, improper authentication may lead to information disclosure. |
CVE-2024-24778 | Medium | 6.5 | 2025-03-03 | Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affec… |
CVE-2024-10925 | Medium | 5.3 | 2025-03-03 | A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Secur… |
CVE-2024-8186 | Medium | 5.4 | 2025-03-03 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inje… |
CVE-2024-53386 | Medium | 4.9 | 2025-03-03 | Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because doc… |
CVE-2024-53382 | Medium | 4.9 | 2025-03-03 | Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript)… |
CVE-2024-36353 | Medium | 6.5 | 2025-03-02 | Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss… |
CVE-2024-55907 | Low | 2.0 | 2025-03-02 | IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique… |
CVE-2024-41778 | Medium | 5.3 | 2025-03-01 | IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to com… |
CVE-2024-13833 | High | 7.2 | 2025-03-01 | The Album Gallery – WordPress Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.3 via deserializatio… |
CVE-2024-13546 | Medium | 4.3 | 2025-03-01 | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'get_image_descript… |
CVE-2024-13910 | High | 7.2 | 2025-03-01 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2024-13697 | Medium | 4.8 | 2025-03-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery… |
CVE-2024-13611 | High | 7.5 | 2025-03-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Expos… |
CVE-2024-13911 | High | 7.2 | 2025-03-01 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-13806 | Medium | 6.5 | 2025-03-01 | The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the softwa… |
CVE-2024-12544 | High | 8.8 | 2025-03-01 | The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary fi… |
CVE-2024-13373 | High | 8.1 | 2025-03-01 | The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due… |
CVE-2024-12824 | Critical | 9.8 | 2025-03-01 | The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6… |
CVE-2024-13901 | Medium | 4.4 | 2025-03-01 | The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting… |
CVE-2024-9217 | Medium | 6.1 | 2025-03-01 | The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate… |
CVE-2024-9212 | Medium | 6.1 | 2025-03-01 | The SKU Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esca… |
CVE-2024-13750 | Medium | 6.5 | 2025-03-01 | The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to… |
CVE-2024-13746 | Medium | 6.5 | 2025-03-01 | The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability check… |
CVE-2024-13568 | High | 7.5 | 2025-03-01 | The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2024-13559 | Medium | 6.4 | 2025-03-01 | The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions… |
CVE-2024-13518 | Medium | 4.3 | 2025-03-01 | The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing o… |
CVE-2024-13358 | Medium | 4.3 | 2025-03-01 | The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-1509 | Critical | 9.1 | 2025-02-28 | Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the ser… |
CVE-2024-54175 | Medium | 5.5 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditi… |
CVE-2024-44754 | Medium | 6.8 | 2025-02-28 | Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware int… |
CVE-2024-10860 | Medium | 4.3 | 2025-02-28 | The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on t… |
CVE-2024-9195 | High | 8.8 | 2025-02-28 | The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing… |
CVE-2024-9193 | Critical | 9.8 | 2025-02-28 | The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision… |
CVE-2024-9019 | Medium | 6.4 | 2025-02-28 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortco… |
CVE-2024-8425 | Critical | 9.8 | 2025-02-28 | The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_previe… |
CVE-2024-8420 | Critical | 9.8 | 2025-02-28 | The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user… |
CVE-2024-13851 | Medium | 5.5 | 2025-02-28 | The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input s… |
CVE-2024-13832 | Medium | 4.3 | 2025-02-28 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elemento… |
CVE-2024-13831 | High | 7.2 | 2025-02-28 | The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untruste… |
CVE-2024-13716 | Medium | 4.3 | 2025-02-28 | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback()… |
CVE-2024-13638 | Medium | 5.9 | 2025-02-28 | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the… |
CVE-2024-13469 | Medium | 6.4 | 2025-02-28 | The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1… |
CVE-2024-12820 | Medium | 6.4 | 2025-02-28 | The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and includi… |
CVE-2024-13796 | Medium | 5.3 | 2025-02-28 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3… |
CVE-2024-56340 | Medium | 6.5 | 2025-02-28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting… |
CVE-2024-54173 | Medium | 4.7 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace i… |
CVE-2024-12811 | High | 8.8 | 2025-02-28 | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for a… |
CVE-2024-37567 | Critical | 9.1 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. |
CVE-2024-37566 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. |
CVE-2024-36047 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation. |
CVE-2024-36046 | Critical | 9.8 | 2025-02-27 | Infoblox NIOS through 8.6.4 executes with more privileges than required. |
CVE-2024-38292 | Critical | 9.8 | 2025-02-27 | In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation. |
CVE-2024-38291 | High | 8.8 | 2025-02-27 | In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. |
CVE-2024-38290 | Medium | 5.3 | 2025-02-27 | In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met. |
CVE-2024-55160 | Critical | 9.8 | 2025-02-27 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list. |
CVE-2024-51139 | Critical | 9.8 | 2025-02-27 | Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133… |
CVE-2024-51138 | Critical | 9.8 | 2025-02-27 | Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832… |
CVE-2024-41340 | High | 8.4 | 2025-02-27 | An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9… |
CVE-2024-41339 | High | 8.8 | 2025-02-27 | An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2… |
CVE-2024-41338 | High | 7.5 | 2025-02-27 | A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/… |
CVE-2024-41336 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-41335 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-41334 | High | 8.8 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-58042 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: rhashtable: Fix potential deadlock by moving schedule_work outside lock Move the hash tab… |
CVE-2024-58034 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As… |
CVE-2024-58022 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: mailbox: th1520: Fix a NULL vs IS_ERR() bug The devm_ioremap() function doesn't return er… |
CVE-2024-54957 | Medium | 6.1 | 2025-02-27 | Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an at… |
CVE-2024-53944 | Critical | 9.8 | 2025-02-27 | An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.148… |
CVE-2024-53408 | Medium | 5.4 | 2025-02-27 | AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2024-9285 | Medium | 4.3 | 2025-02-27 | A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2024-56812 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56811 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56810 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56496 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56495 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56494 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-56493 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-54170 | Medium | 5.5 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity that consumes excessiv… |
CVE-2024-54169 | Medium | 6.5 | 2025-02-27 | IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing… |
CVE-2024-13148 | Critical | 9.8 | 2025-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform allows SQL Injection… |
CVE-2024-9334 | High | 8.2 | 2025-02-27 | Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authenti… |
CVE-2024-13402 | Medium | 6.4 | 2025-02-27 | The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2… |