2024 CVEs (page 31)
Page 31 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13513 | Critical | 9.8 | 2025-02-15 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2024-13306 | Medium | 4.3 | 2025-02-15 | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-13208 | Medium | 4.3 | 2025-02-15 | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-5462 | High | 7.5 | 2025-02-15 | If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be e… |
CVE-2024-5461 | High | 8.0 | 2025-02-15 | Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to… |
CVE-2024-4282 | Critical | 9.8 | 2025-02-15 | Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. |
CVE-2024-10405 | Medium | 5.3 | 2025-02-15 | Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav dat… |
CVE-2024-31144 | Low | 3.8 | 2025-02-14 | For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to b… |
CVE-2024-8893 | High | 7.3 | 2025-02-14 | Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the we… |
CVE-2024-57790 | Medium | 5.4 | 2025-02-14 | IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vul… |
CVE-2024-56463 | Medium | 4.8 | 2025-02-14 | IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2024-3220 | | 2025-02-14 | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users… | |
CVE-2024-57778 | High | 8.8 | 2025-02-14 | An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to st… |
CVE-2024-57725 | Medium | 6.5 | 2025-02-14 | An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an interne… |
CVE-2024-56973 | Critical | 9.8 | 2025-02-14 | Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the sourc… |
CVE-2024-56477 | Medium | 6.5 | 2025-02-14 | IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially… |
CVE-2024-52895 | Medium | 6.5 | 2025-02-14 | IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor… |
CVE-2024-56180 | Critical | 9.8 | 2025-02-14 | CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\m… |
CVE-2024-12651 | High | 8.5 | 2025-02-14 | Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App… |
CVE-2024-52500 | High | 7.2 | 2025-02-14 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2024-13152 | Critical | 10.0 | 2025-02-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allo… |
CVE-2024-13791 | Medium | 4.9 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes… |
CVE-2024-52577 | Critical | 9.0 | 2025-02-14 | In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could b… |
CVE-2024-13735 | Medium | 6.4 | 2025-02-14 | The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all v… |
CVE-2024-9601 | Medium | 6.5 | 2025-02-14 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versi… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2024-7052 | Medium | 4.8 | 2025-02-14 | The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to… |
CVE-2024-13692 | Medium | 5.4 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2024-13641 | Medium | 5.9 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2024-13493 | Medium | 4.8 | 2025-02-14 | The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-2240 | High | 7.2 | 2025-02-14 | Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various at… |
CVE-2024-55904 | High | 7.2 | 2025-02-14 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 / IBM UrbanCode Deploy 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 thr… |
CVE-2024-10404 | Medium | 5.5 | 2025-02-14 | CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker… |
CVE-2024-57782 | Medium | 6.8 | 2025-02-13 | An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service. |
CVE-2024-56908 | Medium | 6.8 | 2025-02-13 | In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input… |
CVE-2024-54951 | Medium | 5.4 | 2025-02-13 | Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customizati… |
CVE-2024-53311 | Medium | 5.5 | 2025-02-13 | A Stack buffer overflow in the arguments parameter in Immunity Inc. Immunity Debugger v1.85 allows attackers to execute arbitrary code via a crafted input that… |
CVE-2024-53310 | Medium | 5.5 | 2025-02-13 | A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when a specially craft… |
CVE-2024-53309 | Medium | 5.5 | 2025-02-13 | A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the "… |
CVE-2024-37603 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export function of NTG 6 h… |
CVE-2024-37602 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer dereference in the Apple Car Play function aff… |
CVE-2024-37601 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in the user data import/export function of N… |
CVE-2024-37600 | Medium | 6.8 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible stack buffer overflow in the Service Broker service affects… |
CVE-2024-12054 | Medium | 5.4 | 2025-02-13 | ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds… |
CVE-2024-57378 | High | 7.3 | 2025-02-13 | Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning… |
CVE-2024-11347 | High | 7.3 | 2025-02-13 | Integer Overflow or Wraparound vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) allows Forced Integer Overflow.The v… |
CVE-2024-11346 | High | 7.3 | 2025-02-13 | : Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) all… |
CVE-2024-11345 | High | 7.3 | 2025-02-13 | A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attack… |
CVE-2024-11344 | High | 7.3 | 2025-02-13 | A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker… |
CVE-2024-12013 | High | 7.6 | 2025-02-13 | A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server wit… |
CVE-2024-12012 | Medium | 5.7 | 2025-02-13 | A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the… |
CVE-2024-12011 | High | 7.6 | 2025-02-13 | A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by… |
CVE-2024-13182 | Critical | 9.8 | 2025-02-13 | The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect aut… |
CVE-2024-13867 | Medium | 6.1 | 2025-02-13 | The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, a… |
CVE-2024-13606 | High | 7.5 | 2025-02-13 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2024-3303 | Medium | 6.4 | 2025-02-13 | An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prio… |
CVE-2024-13639 | Medium | 4.3 | 2025-02-13 | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteD… |
CVE-2024-47266 | Low | 2.7 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Bus… |
CVE-2024-47265 | Medium | 6.5 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup… |
CVE-2024-47264 | Medium | 4.9 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Busin… |
CVE-2024-13346 | High | 7.3 | 2025-02-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13345 | High | 7.3 | 2025-02-13 | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the softwar… |
CVE-2024-13125 | Low | 3.5 | 2025-02-13 | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13121 | Low | 3.5 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-13120 | Medium | 4.8 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-13119 | Medium | 4.8 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-12586 | Medium | 6.1 | 2025-02-13 | The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2024-10083 | Medium | 5.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked… |
CVE-2024-13770 | High | 8.1 | 2025-02-13 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and includ… |
CVE-2024-13229 | Medium | 4.3 | 2025-02-13 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on… |
CVE-2024-13227 | Medium | 6.4 | 2025-02-13 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Rank Math API in a… |
CVE-2024-10763 | Critical | 9.8 | 2025-02-13 | The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_produc… |
CVE-2024-13644 | Medium | 6.4 | 2025-02-13 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all versions up to, and in… |
CVE-2024-8266 | Medium | 4.4 | 2025-02-13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a p… |
CVE-2024-7102 | Critical | 9.6 | 2025-02-13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another use… |
CVE-2024-51376 | High | 7.5 | 2025-02-12 | Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFile.action?path= com… |
CVE-2024-34521 | Low | 3.5 | 2025-02-12 | A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an administrative us… |
CVE-2024-34520 | High | 8.8 | 2025-02-12 | An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an authenticated '… |
CVE-2024-57605 | Medium | 5.4 | 2025-02-12 | Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages componen… |
CVE-2024-57604 | Critical | 9.8 | 2025-02-12 | An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. |
CVE-2024-57603 | Medium | 6.3 | 2025-02-12 | An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting. |
CVE-2024-57602 | Critical | 9.8 | 2025-02-12 | An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. |
CVE-2024-57601 | Medium | 6.1 | 2025-02-12 | Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parame… |
CVE-2024-56940 | High | 7.5 | 2025-02-12 | An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads. |
CVE-2024-56939 | Medium | 5.4 | 2025-02-12 | LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class. |
CVE-2024-56938 | Medium | 5.4 | 2025-02-12 | LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class. |
CVE-2024-51440 | High | 7.8 | 2025-02-12 | An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component. |
CVE-2024-51123 | High | 7.5 | 2025-02-12 | An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via the /compose-pdf.x… |
CVE-2024-51122 | Medium | 6.1 | 2025-02-12 | Cross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arbitrary code via the… |
CVE-2024-47006 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may allow an authenticat… |
CVE-2024-46923 | High | 7.5 | 2025-02-12 | An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_ib_fill… |
CVE-2024-46922 | High | 7.5 | 2025-02-12 | An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The absence of a null check leads to a Denial of Service at amdgpu_cs_parser_bos in t… |
CVE-2024-42492 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.0002 may allow a privi… |
CVE-2024-42419 | Medium | 6.7 | 2025-02-12 | Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentially enable escala… |
CVE-2024-42410 | Medium | 6.5 | 2025-02-12 | Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-42405 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable… |
CVE-2024-41934 | Medium | 5.9 | 2025-02-12 | Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2024-41917 | High | 7.5 | 2025-02-12 | Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticated user to potent… |
CVE-2024-41168 | High | 7.4 | 2025-02-12 | Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentia… |