2024 CVEs (page 28)
Page 28 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57953 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: rtc: tps6594: Fix integer overflow on 32bit systems The problem is this multiply in tps65… |
CVE-2024-57040 | Critical | 9.8 | 2025-02-26 | TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account… |
CVE-2024-55581 | High | 7.4 | 2025-02-26 | When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of ve… |
CVE-2024-53573 | Critical | 9.8 | 2025-02-26 | Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative… |
CVE-2024-57423 | Medium | 6.1 | 2025-02-26 | A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assess… |
CVE-2024-50696 | High | 7.5 | 2025-02-26 | SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an… |
CVE-2024-50693 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model. |
CVE-2024-50691 | High | 7.4 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is… |
CVE-2024-50689 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model. |
CVE-2024-50688 | Critical | 9.8 | 2025-02-26 | SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the clou… |
CVE-2024-50687 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model. |
CVE-2024-50686 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model. |
CVE-2024-50685 | Critical | 9.1 | 2025-02-26 | SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model. |
CVE-2024-50684 | Medium | 6.5 | 2025-02-26 | SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to d… |
CVE-2024-53427 | High | 8.1 | 2025-02-26 | decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overfl… |
CVE-2024-46226 | Medium | 4.8 | 2025-02-26 | A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by… |
CVE-2024-52925 | Medium | 6.8 | 2025-02-26 | In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypt… |
CVE-2024-6810 | Medium | 4.4 | 2025-02-26 | The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sani… |
CVE-2024-47053 | High | 7.7 | 2025-02-26 | This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensi… |
CVE-2024-47051 | Critical | 9.1 | 2025-02-26 | This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticate… |
CVE-2024-39441 | High | 7.1 | 2025-02-26 | In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. |
CVE-2024-13803 | Medium | 6.4 | 2025-02-26 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-mark… |
CVE-2024-13678 | Medium | 6.1 | 2025-02-26 | The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13669 | Medium | 6.1 | 2025-02-26 | The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-13634 | Medium | 6.1 | 2025-02-26 | The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-13633 | High | 7.1 | 2025-02-26 | The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-13632 | High | 7.1 | 2025-02-26 | The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-13631 | High | 7.1 | 2025-02-26 | The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-13630 | Medium | 6.1 | 2025-02-26 | The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13629 | Medium | 6.1 | 2025-02-26 | The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2024-13628 | Medium | 6.1 | 2025-02-26 | The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-13624 | High | 7.1 | 2025-02-26 | The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-13571 | High | 7.1 | 2025-02-26 | The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-13560 | Medium | 4.3 | 2025-02-26 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This i… |
CVE-2024-13113 | Medium | 5.9 | 2025-02-26 | The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allo… |
CVE-2024-12878 | High | 7.1 | 2025-02-26 | The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12737 | Medium | 6.1 | 2025-02-26 | The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in th… |
CVE-2024-12434 | Medium | 5.3 | 2025-02-26 | The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes… |
CVE-2024-10563 | Medium | 5.4 | 2025-02-26 | The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in… |
CVE-2024-10483 | High | 7.1 | 2025-02-26 | The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-10152 | High | 7.1 | 2025-02-26 | The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-53879 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53878 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53877 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed… |
CVE-2024-53876 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed EL… |
CVE-2024-53875 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53874 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53873 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF fil… |
CVE-2024-53872 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53871 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed EL… |
CVE-2024-53870 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-27246 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27245 | Medium | 4.3 | 2025-02-25 | Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27239 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-0148 | High | 7.6 | 2025-02-25 | NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the de… |
CVE-2024-45426 | Medium | 4.9 | 2025-02-25 | Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45425 | Medium | 4.9 | 2025-02-25 | Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45424 | Medium | 5.3 | 2025-02-25 | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2024-45421 | High | 8.5 | 2025-02-25 | Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2024-45418 | Medium | 5.4 | 2025-02-25 | Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via… |
CVE-2024-45417 | Medium | 6.0 | 2025-02-25 | Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of inf… |
CVE-2024-36259 | High | 7.5 | 2025-02-25 | Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information v… |
CVE-2024-12368 | High | 8.1 | 2025-02-25 | Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other us… |
CVE-2024-11955 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /i… |
CVE-2024-54444 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2024-34036 | Medium | 4.3 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection between a gNB and t… |
CVE-2024-34035 | Medium | 5.7 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with a significant quant… |
CVE-2024-34034 | Medium | 5.7 | 2025-02-25 | An issue was discovered in FlexRIC 2.0.0. It crashes during a Subscription Request denial-of-service (DoS) attack, triggered by an assertion error. An attacker… |
CVE-2024-51539 | Low | 2.3 | 2025-02-25 | The Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improper neutralization… |
CVE-2024-13695 | Medium | 6.4 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2024-13494 | Medium | 4.3 | 2025-02-25 | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing… |
CVE-2024-10545 | Low | 3.5 | 2025-02-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privi… |
CVE-2024-57685 | Medium | 5.3 | 2025-02-24 | An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file. |
CVE-2024-56525 | Critical | 9.8 | 2025-02-24 | In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as… |
CVE-2024-53544 | Critical | 9.8 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the s… |
CVE-2024-53543 | Medium | 5.4 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smart… |
CVE-2024-53542 | Medium | 6.5 | 2025-02-24 | Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to… |
CVE-2024-57608 | Medium | 6.5 | 2025-02-24 | An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component. |
CVE-2024-57026 | Medium | 6.1 | 2025-02-24 | TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript execution. |
CVE-2024-54820 | Critical | 9.8 | 2025-02-24 | XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attacke… |
CVE-2024-56897 | Critical | 9.8 | 2025-02-24 | Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made… |
CVE-2024-12918 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This iss… |
CVE-2024-12917 | High | 8.3 | 2025-02-24 | Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-12916 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue… |
CVE-2024-5174 | | 2025-02-24 | A flaw in Gliffy results in broken authentication through the reset functionality of the application. | |
CVE-2024-13822 | Medium | 6.1 | 2025-02-24 | The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2024-13605 | Medium | 4.8 | 2025-02-24 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12308 | Medium | 5.4 | 2025-02-24 | The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2024-55898 | High | 8.5 | 2025-02-24 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library c… |
CVE-2024-13728 | Medium | 6.1 | 2025-02-23 | The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the rf parameter in all versions up to, and… |
CVE-2024-52939 | High | 7.8 | 2025-02-22 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised… |
CVE-2024-47896 | Low | 3.3 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memor… |
CVE-2024-46975 | High | 7.9 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memo… |
CVE-2024-12577 | High | 7.3 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memor… |
CVE-2024-13869 | High | 7.2 | 2025-02-22 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2024-13564 | Medium | 6.4 | 2025-02-22 | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode… |
CVE-2024-13798 | Medium | 5.3 | 2025-02-22 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5… |
CVE-2024-13474 | High | 7.5 | 2025-02-22 | The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versi… |