2024 CVEs (page 35)
Page 35 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56470 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2024-38318 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2024-38317 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript co… |
CVE-2024-38316 | Medium | 4.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email f… |
CVE-2024-57699 | High | 7.5 | 2025-02-05 | A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack ex… |
CVE-2024-57598 | Medium | 6.5 | 2025-02-05 | A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remot… |
CVE-2024-57520 | Critical | 9.8 | 2025-02-05 | Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is dispu… |
CVE-2024-57086 | High | 7.5 | 2025-02-05 | A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57085 | High | 7.5 | 2025-02-05 | A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pay… |
CVE-2024-57084 | High | 7.5 | 2025-02-05 | A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57082 | Medium | 6.5 | 2025-02-05 | A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… |
CVE-2024-57081 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pa… |
CVE-2024-57080 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57079 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57078 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57077 | Critical | 9.1 | 2025-02-05 | The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with… |
CVE-2024-57076 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57075 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57074 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57072 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-57071 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57069 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57068 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-57067 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57066 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57065 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57064 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57063 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-54853 | Medium | 5.4 | 2025-02-05 | A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated… |
CVE-2024-48394 | High | 7.8 | 2025-02-05 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to ex… |
CVE-2024-7596 | Medium | 6.5 | 2025-02-05 | Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrar… |
CVE-2024-7595 | Medium | 6.5 | 2025-02-05 | GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an expo… |
CVE-2024-56135 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56134 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56133 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56132 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56131 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2024-39564 | High | 7.5 | 2025-02-05 | This is a similar, but different vulnerability than the issue reported as CVE-2024-39549. A double-free vulnerability in the routing process daemon (rpd) of J… |
CVE-2024-9097 | Low | 3.5 | 2025-02-05 | ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. |
CVE-2024-2878 | High | 7.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-52365 | Medium | 6.4 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is v… |
CVE-2024-52364 | Medium | 5.4 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2024-49348 | Medium | 4.3 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2024-3976 | Medium | 6.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-9631 | High | 7.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-5528 | Low | 3.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, wh… |
CVE-2024-49352 | High | 7.1 | 2025-02-05 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE)… |
CVE-2024-6356 | Medium | 4.4 | 2025-02-05 | An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2024-1539 | Medium | 4.3 | 2025-02-05 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16… |
CVE-2024-13829 | Medium | 5.3 | 2025-02-05 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all… |
CVE-2024-53966 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-53965 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2024-53964 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-53963 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2024-53962 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-48445 | Critical | 9.8 | 2025-02-04 | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. |
CVE-2024-11468 | High | 7.8 | 2025-02-04 | Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation o… |
CVE-2024-11467 | High | 7.8 | 2025-02-04 | Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow… |
CVE-2024-8125 | | 2025-02-04 | Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection. A bad actor with the… | |
CVE-2024-53994 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some case… |
CVE-2024-53851 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limit… |
CVE-2024-53266 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams… |
CVE-2024-13723 | High | 7.2 | 2025-02-04 | The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload… |
CVE-2024-13722 | Medium | 5.4 | 2025-02-04 | The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaS… |
CVE-2024-56328 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted… |
CVE-2024-56197 | Low | 2.2 | 2025-02-04 | Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option i… |
CVE-2024-55948 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (fo… |
CVE-2024-45658 | Low | 2.7 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-45657 | Medium | 5.0 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect p… |
CVE-2024-43187 | Medium | 5.9 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel… |
CVE-2024-40700 | Medium | 6.1 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated at… |
CVE-2024-35138 | Medium | 6.5 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute m… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2024-45659 | Medium | 5.3 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-9644 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is… |
CVE-2024-9643 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An att… |
CVE-2024-23690 | High | 7.2 | 2025-02-04 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker… |
CVE-2024-11623 | Medium | 4.8 | 2025-02-04 | Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be perfor… |
CVE-2024-13699 | Medium | 6.4 | 2025-02-04 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2024-40891 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmwar… |
CVE-2024-40890 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware versio… |
CVE-2024-13733 | Medium | 6.4 | 2025-02-04 | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block… |
CVE-2024-13529 | Medium | 6.5 | 2025-02-04 | The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2024-13510 | Medium | 6.1 | 2025-02-04 | The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect… |
CVE-2024-13356 | Medium | 6.5 | 2025-02-04 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing… |
CVE-2024-13403 | Medium | 6.4 | 2025-02-04 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-13514 | Medium | 4.3 | 2025-02-04 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb… |
CVE-2024-12046 | Medium | 4.3 | 2025-02-04 | The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.2 via the 'nam… |
CVE-2024-10239 | High | 7.2 | 2025-02-04 | A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specia… |
CVE-2024-10238 | High | 7.2 | 2025-02-04 | A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will… |
CVE-2024-10237 | High | 7.2 | 2025-02-04 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC i… |
CVE-2024-13607 | Medium | 4.3 | 2025-02-04 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and in… |
CVE-2024-12597 | Medium | 6.4 | 2025-02-04 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner_css' parameters in… |
CVE-2024-13332 | Medium | 6.1 | 2025-02-04 | The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13331 | Medium | 6.1 | 2025-02-04 | The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13330 | High | 7.1 | 2025-02-04 | The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13329 | High | 7.1 | 2025-02-04 | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13328 | Medium | 6.1 | 2025-02-04 | The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |