2024 CVEs (page 33)
Page 33 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13475 | High | 7.5 | 2025-02-12 | The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 4… |
CVE-2024-13473 | High | 7.5 | 2025-02-12 | The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameter in al… |
CVE-2024-13459 | Medium | 6.4 | 2025-02-12 | The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and includi… |
CVE-2024-13456 | Medium | 6.4 | 2025-02-12 | The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versions up to, and incl… |
CVE-2024-13437 | Medium | 4.3 | 2025-02-12 | The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect… |
CVE-2024-13435 | High | 7.5 | 2025-02-12 | The Ebook Downloader plugin for WordPress is vulnerable to SQL Injection via the 'download' parameter in all versions up to, and including, 1.0 due to insuffic… |
CVE-2024-13365 | Critical | 9.8 | 2025-02-12 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives… |
CVE-2024-12296 | High | 8.8 | 2025-02-12 | The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch… |
CVE-2024-12213 | Critical | 9.8 | 2025-02-12 | The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supp… |
CVE-2024-13814 | Medium | 5.4 | 2025-02-12 | The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-12315 | High | 7.5 | 2025-02-12 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… |
CVE-2024-13821 | Medium | 5.3 | 2025-02-12 | The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.1… |
CVE-2024-13794 | Medium | 5.3 | 2025-02-12 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02… |
CVE-2024-13714 | High | 8.8 | 2025-02-12 | The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2024-13601 | Medium | 4.3 | 2025-02-12 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi… |
CVE-2024-13600 | High | 7.5 | 2025-02-12 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2024-13374 | Medium | 4.3 | 2025-02-12 | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX action in all versi… |
CVE-2024-13800 | High | 8.1 | 2025-02-12 | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check… |
CVE-2024-13769 | Medium | 6.4 | 2025-02-12 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capabilit… |
CVE-2024-13665 | Medium | 6.4 | 2025-02-12 | The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, and including, 1.6… |
CVE-2024-13658 | Medium | 6.4 | 2025-02-12 | The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versi… |
CVE-2024-13656 | High | 8.1 | 2025-02-12 | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of se… |
CVE-2024-13654 | High | 8.1 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service… |
CVE-2024-13653 | High | 8.8 | 2025-02-12 | The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2024-13421 | Critical | 9.8 | 2025-02-12 | The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin no… |
CVE-2024-12164 | Medium | 4.3 | 2025-02-12 | The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-11746 | Medium | 6.4 | 2025-02-12 | The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2024-13749 | Medium | 6.1 | 2025-02-12 | The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect… |
CVE-2024-13701 | Medium | 6.4 | 2025-02-12 | The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, a… |
CVE-2024-13554 | Medium | 5.3 | 2025-02-12 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-13541 | Medium | 4.3 | 2025-02-12 | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ad… |
CVE-2024-13539 | Medium | 5.3 | 2025-02-12 | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-in… |
CVE-2024-29172 | Medium | 5.9 | 2025-02-12 | Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentially exploit this vulne… |
CVE-2024-29171 | Medium | 5.9 | 2025-02-12 | Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability. A remote attacker could pote… |
CVE-2024-53880 | Medium | 4.9 | 2025-02-12 | NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a… |
CVE-2024-0145 | Medium | 6.8 | 2025-02-12 | NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based buffer overflow issue by means of a specially crafted JPEG2000 file… |
CVE-2024-0144 | Medium | 6.8 | 2025-02-12 | NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2000 file. A success… |
CVE-2024-0143 | Medium | 6.8 | 2025-02-12 | NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted JPEG2000 file. A su… |
CVE-2024-21971 | Medium | 5.5 | 2025-02-12 | Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an oper… |
CVE-2024-0142 | Medium | 6.8 | 2025-02-12 | NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted JPEG2000 file. A su… |
CVE-2024-0112 | High | 7.5 | 2025-02-12 | NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certa… |
CVE-2024-54916 | Medium | 6.8 | 2025-02-11 | An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by… |
CVE-2024-54772 | Medium | 5.4 | 2025-02-11 | An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is ava… |
CVE-2024-44336 | Medium | 5.3 | 2025-02-11 | An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into pu… |
CVE-2024-33469 | High | 7.9 | 2025-02-11 | An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate method of DatabaseView… |
CVE-2024-57777 | Medium | 5.1 | 2025-02-11 | Directory Traversal vulnerability in Ianproxy v.0.1 and before allows a remote attacker to obtain sensitive information |
CVE-2024-57241 | Medium | 6.5 | 2025-02-11 | Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirect… |
CVE-2024-55212 | Medium | 6.5 | 2025-02-11 | DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx. |
CVE-2024-51324 | Low | 3.8 | 2025-02-11 | An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnera… |
CVE-2024-32037 | Unrated | | 2025-02-11 | GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers cont… |
CVE-2024-21925 | High | 8.2 | 2025-02-11 | Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution. |
CVE-2024-21924 | High | 8.2 | 2025-02-11 | SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbit… |
CVE-2024-0179 | High | 8.2 | 2025-02-11 | SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in ar… |
CVE-2024-21966 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary cod… |
CVE-2024-12833 | Medium | 6.1 | 2025-02-11 | Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass aut… |
CVE-2024-12551 | High | 7.8 | 2025-02-11 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-12550 | High | 7.8 | 2025-02-11 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2024-12549 | High | 7.8 | 2025-02-11 | Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-12548 | Low | 3.3 | 2025-02-11 | Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2024-12547 | High | 8.8 | 2025-02-11 | Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-52968 | Medium | 6.7 | 2025-02-11 | An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password. |
CVE-2024-52966 | Low | 2.3 | 2025-02-11 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via… |
CVE-2024-50569 | Medium | 6.6 | 2025-02-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execut… |
CVE-2024-50567 | High | 7.2 | 2025-02-11 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execu… |
CVE-2024-40591 | High | 8.8 | 2025-02-11 | An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows… |
CVE-2024-40586 | Medium | 6.7 | 2025-02-11 | An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local us… |
CVE-2024-40584 | High | 7.2 | 2025-02-11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer version 7.4.0 th… |
CVE-2024-36508 | Medium | 6.0 | 2025-02-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 a… |
CVE-2024-35279 | High | 8.1 | 2025-02-11 | A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthent… |
CVE-2024-33504 | Medium | 4.1 | 2025-02-11 | A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through… |
CVE-2024-27781 | High | 7.1 | 2025-02-11 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbo… |
CVE-2024-27780 | Low | 2.2 | 2025-02-11 | Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions, 7.0 all… |
CVE-2024-12756 | High | 7.3 | 2025-02-11 | An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user. |
CVE-2024-12755 | High | 7.9 | 2025-02-11 | A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information. |
CVE-2024-47908 | Critical | 9.1 | 2025-02-11 | OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote… |
CVE-2024-13843 | Medium | 6.0 | 2025-02-11 | Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated… |
CVE-2024-13842 | Medium | 6.0 | 2025-02-11 | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with ad… |
CVE-2024-13830 | Medium | 6.1 | 2025-02-11 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obt… |
CVE-2024-13813 | High | 7.1 | 2025-02-11 | Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files. |
CVE-2024-12797 | Medium | 6.3 | 2025-02-11 | Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshak… |
CVE-2024-12058 | Medium | 6.8 | 2025-02-11 | External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… |
CVE-2024-11771 | Medium | 5.3 | 2025-02-11 | Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2024-10644 | Critical | 9.1 | 2025-02-11 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with ad… |
CVE-2024-33659 | High | 8.8 | 2025-02-11 | AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vuln… |
CVE-2024-12366 | Critical | 9.8 | 2025-02-11 | PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE)… |
CVE-2024-54090 | Medium | 5.9 | 2025-02-11 | A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All… |
CVE-2024-54089 | High | 7.5 | 2025-02-11 | A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All… |
CVE-2024-54015 | High | 7.5 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6M… |
CVE-2024-53977 | Medium | 6.7 | 2025-02-11 | A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applic… |
CVE-2024-53651 | Medium | 4.6 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions… |
CVE-2024-53648 | Medium | 6.8 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2024-45386 | High | 8.8 | 2025-02-11 | A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All vers… |
CVE-2024-23814 | Medium | 5.3 | 2025-02-11 | The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted… |
CVE-2024-13506 | Medium | 6.4 | 2025-02-11 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the dis… |
CVE-2024-52612 | Medium | 6.8 | 2025-02-11 | SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vu… |
CVE-2024-52611 | Low | 3.5 | 2025-02-11 | The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive… |
CVE-2024-52606 | Low | 3.5 | 2025-02-11 | SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicio… |
CVE-2024-45718 | Medium | 4.6 | 2025-02-11 | Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to a… |
CVE-2024-28989 | Medium | 5.5 | 2025-02-11 | SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software. |
CVE-2024-13643 | High | 8.8 | 2025-02-11 | The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead t… |