2024 CVEs (page 35)
Page 35 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39272 | Critical | 9.0 | 2025-02-06 | A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP reques… |
CVE-2024-39033 | High | 7.5 | 2025-02-06 | In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stole… |
CVE-2024-13614 | Medium | 5.3 | 2025-02-06 | Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security fo… |
CVE-2024-24911 | Medium | 5.3 | 2025-02-06 | In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpc… |
CVE-2024-57962 | Medium | 6.1 | 2025-02-06 | Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-57961 | Medium | 6.8 | 2025-02-06 | Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57960 | High | 7.7 | 2025-02-06 | Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-57959 | Medium | 6.1 | 2025-02-06 | Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57958 | Medium | 5.7 | 2025-02-06 | Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-57957 | Medium | 6.6 | 2025-02-06 | Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-57956 | Low | 2.8 | 2025-02-06 | Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-57955 | Medium | 6.1 | 2025-02-06 | Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-57954 | Medium | 6.2 | 2025-02-06 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-12602 | Medium | 6.2 | 2025-02-06 | Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45626 | Medium | 6.5 | 2025-02-06 | Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a de… |
CVE-2024-37358 | High | 8.6 | 2025-02-06 | Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated use… |
CVE-2024-13487 | High | 7.3 | 2025-02-06 | The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to… |
CVE-2024-51547 | Critical | 9.8 | 2025-02-06 | Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NE… |
CVE-2024-51450 | Critical | 9.1 | 2025-02-06 | IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2024-49814 | High | 7.8 | 2025-02-06 | IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecess… |
CVE-2024-49800 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. |
CVE-2024-49798 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informa… |
CVE-2024-49797 | Medium | 5.9 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An att… |
CVE-2024-49796 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2024-49795 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2024-49794 | Medium | 4.3 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2024-49793 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-49792 | Medium | 5.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-49791 | Medium | 6.4 | 2025-02-06 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2024-56473 | Medium | 5.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of '… |
CVE-2024-56472 | Medium | 6.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary Java… |
CVE-2024-56471 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2024-56470 | Medium | 5.4 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2024-38318 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2024-38317 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript co… |
CVE-2024-38316 | Medium | 4.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email f… |
CVE-2024-57699 | High | 7.5 | 2025-02-05 | A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack ex… |
CVE-2024-57598 | Medium | 6.5 | 2025-02-05 | A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remot… |
CVE-2024-57520 | Critical | 9.8 | 2025-02-05 | Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is dispu… |
CVE-2024-57086 | High | 7.5 | 2025-02-05 | A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57085 | High | 7.5 | 2025-02-05 | A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pay… |
CVE-2024-57084 | High | 7.5 | 2025-02-05 | A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57082 | Medium | 6.5 | 2025-02-05 | A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… |
CVE-2024-57081 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted pa… |
CVE-2024-57080 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57079 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57078 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57077 | Critical | 9.1 | 2025-02-05 | The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with… |
CVE-2024-57076 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57075 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57074 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57072 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-57071 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57069 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57068 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-57067 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57066 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57065 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57064 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57063 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-54853 | Medium | 5.4 | 2025-02-05 | A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated… |
CVE-2024-48394 | High | 7.8 | 2025-02-05 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to ex… |
CVE-2024-7596 | Medium | 6.5 | 2025-02-05 | Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrar… |
CVE-2024-7595 | Medium | 6.5 | 2025-02-05 | GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an expo… |
CVE-2024-56135 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56134 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56133 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56132 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56131 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2024-39564 | High | 7.5 | 2025-02-05 | This is a similar, but different vulnerability than the issue reported as CVE-2024-39549. A double-free vulnerability in the routing process daemon (rpd) of J… |
CVE-2024-9097 | Low | 3.5 | 2025-02-05 | ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. |
CVE-2024-2878 | High | 7.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-52365 | Medium | 6.4 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is v… |
CVE-2024-52364 | Medium | 5.4 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2024-49348 | Medium | 4.3 | 2025-02-05 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2024-3976 | Medium | 6.5 | 2025-02-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-9631 | High | 7.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-5528 | Low | 3.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, wh… |
CVE-2024-49352 | High | 7.1 | 2025-02-05 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE)… |
CVE-2024-6356 | Medium | 4.4 | 2025-02-05 | An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2024-1539 | Medium | 4.3 | 2025-02-05 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16… |
CVE-2024-13829 | Medium | 5.3 | 2025-02-05 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all… |
CVE-2024-53966 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-53965 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2024-53964 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-53963 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2024-53962 | Medium | 5.4 | 2025-02-05 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-48445 | Critical | 9.8 | 2025-02-04 | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. |
CVE-2024-11468 | High | 7.8 | 2025-02-04 | Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation o… |
CVE-2024-11467 | High | 7.8 | 2025-02-04 | Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow… |
CVE-2024-8125 | | 2025-02-04 | Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection. A bad actor with the… | |
CVE-2024-53994 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some case… |
CVE-2024-53851 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limit… |
CVE-2024-53266 | Medium | 4.3 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams… |
CVE-2024-13723 | High | 7.2 | 2025-02-04 | The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload… |
CVE-2024-13722 | Medium | 5.4 | 2025-02-04 | The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaS… |
CVE-2024-56328 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted… |
CVE-2024-56197 | Low | 2.2 | 2025-02-04 | Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option i… |
CVE-2024-55948 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (fo… |