2024 CVEs (page 34)
Page 34 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11831 | Medium | 5.4 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such… |
CVE-2024-10334 | High | 7.3 | 2025-02-10 | A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited t… |
CVE-2024-11621 | High | 8.8 | 2025-02-10 | Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communi… |
CVE-2024-8685 | Medium | 4.3 | 2025-02-10 | Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to lis… |
CVE-2024-8684 | High | 8.3 | 2025-02-10 | OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker… |
CVE-2024-57949 | Medium | 5.5 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The following… |
CVE-2024-13440 | High | 8.2 | 2025-02-09 | The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due t… |
CVE-2024-54176 | Medium | 4.3 | 2025-02-08 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and… |
CVE-2024-13850 | Medium | 5.5 | 2025-02-08 | The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient… |
CVE-2024-55630 | Low | 3.3 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer all… |
CVE-2024-57606 | High | 7.5 | 2025-02-07 | SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the… |
CVE-2024-57357 | High | 8.0 | 2025-02-07 | An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows… |
CVE-2024-57279 | Medium | 5.4 | 2025-02-07 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via… |
CVE-2024-57278 | Medium | 5.4 | 2025-02-07 | A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused by improper input s… |
CVE-2024-55272 | High | 7.5 | 2025-02-07 | An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. |
CVE-2024-55215 | Critical | 9.8 | 2025-02-07 | An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register. |
CVE-2024-7425 | Medium | 6.8 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input… |
CVE-2024-9664 | High | 7.2 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted i… |
CVE-2024-9661 | Medium | 4.3 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonc… |
CVE-2024-7419 | High | 8.3 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. Thi… |
CVE-2024-57707 | Critical | 9.8 | 2025-02-07 | An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. |
CVE-2024-57249 | Medium | 6.5 | 2025-02-07 | Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerabil… |
CVE-2024-57248 | Medium | 6.3 | 2025-02-07 | Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of… |
CVE-2024-55214 | Medium | 6.5 | 2025-02-07 | Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality. |
CVE-2024-55213 | Medium | 6.5 | 2025-02-07 | Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function. |
CVE-2024-52884 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an… |
CVE-2024-52883 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read with… |
CVE-2024-52882 | Medium | 6.1 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attack… |
CVE-2024-52881 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sen… |
CVE-2024-48091 | High | 7.8 | 2025-02-07 | Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to exe… |
CVE-2024-35106 | Medium | 4.6 | 2025-02-07 | NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2024-10383 | High | 8.7 | 2025-02-07 | An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343an… |
CVE-2024-13841 | Medium | 4.3 | 2025-02-07 | The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up t… |
CVE-2024-13492 | Medium | 6.1 | 2025-02-07 | The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13352 | High | 7.1 | 2025-02-07 | The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2024-57609 | High | 8.6 | 2025-02-06 | An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path p… |
CVE-2024-57392 | High | 7.5 | 2025-02-06 | Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP… |
CVE-2024-56889 | High | 7.5 | 2025-02-06 | Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete… |
CVE-2024-55241 | High | 8.8 | 2025-02-06 | An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component. |
CVE-2024-54909 | High | 8.1 | 2025-02-06 | A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipula… |
CVE-2024-53586 | Medium | 5.3 | 2025-02-06 | An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. By injecting travers… |
CVE-2024-48589 | Medium | 6.3 | 2025-02-06 | Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter in index.php |
CVE-2024-25883 | Medium | 5.3 | 2025-02-06 | The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. |
CVE-2024-56467 | Low | 3.3 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-54171 | High | 7.1 | 2025-02-06 | IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerab… |
CVE-2024-57673 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module |
CVE-2024-57672 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module. |
CVE-2024-57426 | High | 7.3 | 2025-02-06 | NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the appl… |
CVE-2024-52892 | Medium | 6.1 | 2025-02-06 | IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed ar… |
CVE-2024-47258 | High | 8.1 | 2025-02-06 | 2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices. … |
CVE-2024-47256 | Medium | 6.0 | 2025-02-06 | Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may b… |
CVE-2024-13417 | Medium | 4.6 | 2025-02-06 | Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2… |
CVE-2024-57668 | High | 8.8 | 2025-02-06 | In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability. |
CVE-2024-57523 | Medium | 4.5 | 2025-02-06 | Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin account… |
CVE-2024-13416 | Medium | 4.3 | 2025-02-06 | Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated ve… |
CVE-2024-57610 | High | 7.5 | 2025-02-06 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk… |
CVE-2024-36558 | High | 7.5 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of en… |
CVE-2024-36557 | Medium | 6.6 | 2025-02-06 | The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YD… |
CVE-2024-36556 | Critical | 9.1 | 2025-02-06 | Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49… |
CVE-2024-36555 | Critical | 9.8 | 2025-02-06 | Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36… |
CVE-2024-36554 | Critical | 9.8 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.4… |
CVE-2024-36553 | High | 8.1 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack. |
CVE-2024-57599 | Medium | 4.8 | 2025-02-06 | Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injected into the descript… |
CVE-2024-57430 | Critical | 9.8 | 2025-02-06 | An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the… |
CVE-2024-57429 | Medium | 5.4 | 2025-02-06 | A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate p… |
CVE-2024-57428 | Critical | 9.3 | 2025-02-06 | A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, se… |
CVE-2024-57427 | Medium | 6.1 | 2025-02-06 | PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user input, allowing maliciou… |
CVE-2024-43779 | High | 7.7 | 2025-02-06 | An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can le… |
CVE-2024-39272 | Critical | 9.0 | 2025-02-06 | A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP reques… |
CVE-2024-39033 | High | 7.5 | 2025-02-06 | In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stole… |
CVE-2024-13614 | Medium | 5.3 | 2025-02-06 | Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security fo… |
CVE-2024-24911 | Medium | 5.3 | 2025-02-06 | In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpc… |
CVE-2024-57962 | Medium | 6.1 | 2025-02-06 | Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-57961 | Medium | 6.8 | 2025-02-06 | Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57960 | High | 7.7 | 2025-02-06 | Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-57959 | Medium | 6.1 | 2025-02-06 | Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57958 | Medium | 5.7 | 2025-02-06 | Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57957 | Medium | 6.6 | 2025-02-06 | Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-57956 | Low | 2.8 | 2025-02-06 | Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-57955 | Medium | 6.1 | 2025-02-06 | Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-57954 | Medium | 6.2 | 2025-02-06 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-12602 | Medium | 6.2 | 2025-02-06 | Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45626 | Medium | 6.5 | 2025-02-06 | Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a de… |
CVE-2024-37358 | High | 8.6 | 2025-02-06 | Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated use… |
CVE-2024-13487 | High | 7.3 | 2025-02-06 | The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to… |
CVE-2024-51547 | Critical | 9.8 | 2025-02-06 | Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NE… |
CVE-2024-51450 | Critical | 9.1 | 2025-02-06 | IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2024-49814 | High | 7.8 | 2025-02-06 | IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecess… |
CVE-2024-49800 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. |
CVE-2024-49798 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa… |
CVE-2024-49797 | Medium | 5.9 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An att… |
CVE-2024-49796 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2024-49795 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2024-49794 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2024-49793 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-49792 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-49791 | Medium | 6.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-56473 | Medium | 5.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of '… |
CVE-2024-56472 | Medium | 6.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary Java… |
CVE-2024-56471 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |