2024 CVEs (page 36)
Page 36 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45658 | Low | 2.7 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-45657 | Medium | 5.0 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect p… |
CVE-2024-43187 | Medium | 5.9 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel… |
CVE-2024-40700 | Medium | 6.1 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated at… |
CVE-2024-35138 | Medium | 6.5 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute m… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2024-45659 | Medium | 5.3 | 2025-02-04 | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technica… |
CVE-2024-9644 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is… |
CVE-2024-9643 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An att… |
CVE-2024-23690 | High | 7.2 | 2025-02-04 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker… |
CVE-2024-11623 | Medium | 4.8 | 2025-02-04 | Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be perfor… |
CVE-2024-13699 | Medium | 6.4 | 2025-02-04 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2024-40891 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmwar… |
CVE-2024-40890 | High | 8.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware versio… |
CVE-2024-13733 | Medium | 6.4 | 2025-02-04 | The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block… |
CVE-2024-13529 | Medium | 6.5 | 2025-02-04 | The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check… |
CVE-2024-13510 | Medium | 6.1 | 2025-02-04 | The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect… |
CVE-2024-13356 | Medium | 6.5 | 2025-02-04 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing… |
CVE-2024-13403 | Medium | 6.4 | 2025-02-04 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-13514 | Medium | 4.3 | 2025-02-04 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb… |
CVE-2024-12046 | Medium | 4.3 | 2025-02-04 | The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.2 via the 'nam… |
CVE-2024-10239 | High | 7.2 | 2025-02-04 | A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specia… |
CVE-2024-10238 | High | 7.2 | 2025-02-04 | A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will… |
CVE-2024-10237 | High | 7.2 | 2025-02-04 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC i… |
CVE-2024-13607 | Medium | 4.3 | 2025-02-04 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and in… |
CVE-2024-12597 | Medium | 6.4 | 2025-02-04 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner_css' parameters in… |
CVE-2024-13332 | Medium | 6.1 | 2025-02-04 | The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13331 | Medium | 6.1 | 2025-02-04 | The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13330 | High | 7.1 | 2025-02-04 | The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13329 | High | 7.1 | 2025-02-04 | The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13328 | Medium | 6.1 | 2025-02-04 | The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-13327 | Medium | 6.1 | 2025-02-04 | The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13326 | Medium | 6.1 | 2025-02-04 | The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13325 | Medium | 6.1 | 2025-02-04 | The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2024-13115 | Medium | 6.1 | 2025-02-04 | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as… |
CVE-2024-13114 | Medium | 6.1 | 2025-02-04 | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2024-47770 | Medium | 4.6 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-35177 | High | 7.8 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-57451 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. |
CVE-2024-56903 | High | 8.1 | 2025-02-03 | Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as accou… |
CVE-2024-56902 | High | 7.5 | 2025-02-03 | Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includin… |
CVE-2024-56901 | High | 8.8 | 2025-02-03 | A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily creat… |
CVE-2024-56898 | High | 8.8 | 2025-02-03 | Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that the… |
CVE-2024-44449 | Medium | 6.1 | 2025-02-03 | Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login… |
CVE-2024-34897 | High | 7.5 | 2025-02-03 | Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability. |
CVE-2024-34896 | High | 7.5 | 2025-02-03 | An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection… |
CVE-2024-57968 | Critical | 9.9 | 2025-02-03 | Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsin… |
CVE-2024-57669 | High | 7.5 | 2025-02-03 | Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java… |
CVE-2024-57498 | Medium | 4.8 | 2025-02-03 | Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function. |
CVE-2024-57452 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. |
CVE-2024-57450 | Critical | 9.8 | 2025-02-03 | ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. |
CVE-2024-57099 | Critical | 9.8 | 2025-02-03 | ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model ma… |
CVE-2024-57098 | Critical | 9.8 | 2025-02-03 | Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter. |
CVE-2024-57097 | Medium | 4.8 | 2025-02-03 | ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php. |
CVE-2024-56946 | Medium | 5.3 | 2025-02-03 | Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC… |
CVE-2024-56921 | High | 7.5 | 2025-02-03 | An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_… |
CVE-2024-12859 | High | 8.8 | 2025-02-03 | The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' s… |
CVE-2024-12511 | High | 7.6 | 2025-02-03 | With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pr… |
CVE-2024-11134 | Medium | 4.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function i… |
CVE-2024-11133 | Medium | 5.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function i… |
CVE-2024-11132 | Medium | 6.4 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient inpu… |
CVE-2024-57238 | High | 7.3 | 2025-02-03 | Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allows an attacker to man… |
CVE-2024-57237 | Medium | 6.3 | 2025-02-03 | Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerability arises because… |
CVE-2024-57004 | Medium | 6.1 | 2025-02-03 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadin… |
CVE-2024-50656 | Medium | 6.1 | 2025-02-03 | itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. |
CVE-2024-12510 | Medium | 6.7 | 2025-02-03 | If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active… |
CVE-2024-57967 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping. |
CVE-2024-57175 | Medium | 5.4 | 2025-02-03 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name to /user/certifica… |
CVE-2024-56161 | High | 7.2 | 2025-02-03 | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode… |
CVE-2024-54840 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute… |
CVE-2024-53943 | Medium | 6.1 | 2025-02-03 | An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz… |
CVE-2024-53942 | Medium | 4.8 | 2025-02-03 | An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4… |
CVE-2024-36437 | Medium | 6.5 | 2025-02-03 | The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions)… |
CVE-2024-55456 | Medium | 6.5 | 2025-02-03 | lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell |
CVE-2024-49843 | High | 7.8 | 2025-02-03 | Memory corruption while processing IOCTL from user space to handle GPU AHB bus error. |
CVE-2024-49840 | High | 7.8 | 2025-02-03 | Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality. |
CVE-2024-49839 | High | 8.2 | 2025-02-03 | Memory corruption during management frame processing due to mismatch in T2LM info element. |
CVE-2024-49838 | High | 8.2 | 2025-02-03 | Information disclosure while parsing the OCI IE with invalid length. |
CVE-2024-49837 | High | 7.8 | 2025-02-03 | Memory corruption while reading CPU state data during guest VM suspend. |
CVE-2024-49834 | High | 7.8 | 2025-02-03 | Memory corruption while power-up or power-down sequence of the camera sensor. |
CVE-2024-49833 | High | 7.8 | 2025-02-03 | Memory corruption can occur in the camera when an invalid CID is used. |
CVE-2024-49832 | High | 7.8 | 2025-02-03 | Memory corruption in Camera due to unusually high number of nodes passed to AXI port. |
CVE-2024-45584 | High | 7.8 | 2025-02-03 | Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace. |
CVE-2024-45582 | High | 7.8 | 2025-02-03 | Memory corruption while validating number of devices in Camera kernel . |
CVE-2024-45573 | High | 7.8 | 2025-02-03 | Memory corruption may occour while generating test pattern due to negative indexing of display ID. |
CVE-2024-45571 | High | 7.8 | 2025-02-03 | Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface. |
CVE-2024-45569 | Critical | 9.8 | 2025-02-03 | Memory corruption while parsing the ML IE due to invalid frame content. |
CVE-2024-45561 | High | 7.8 | 2025-02-03 | Memory corruption while handling IOCTL call from user-space to set latency level. |
CVE-2024-45560 | High | 7.8 | 2025-02-03 | Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer. |
CVE-2024-38420 | High | 8.8 | 2025-02-03 | Memory corruption while configuring a Hypervisor based input virtual device. |
CVE-2024-38418 | High | 7.8 | 2025-02-03 | Memory corruption while parsing the memory map info in IOCTL calls. |
CVE-2024-38417 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing IO control commands. |
CVE-2024-38416 | Medium | 6.1 | 2025-02-03 | Information disclosure during audio playback. |
CVE-2024-38414 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing information on firmware image during core initialization. |
CVE-2024-38413 | Medium | 6.6 | 2025-02-03 | Memory corruption while processing frame packets. |
CVE-2024-38412 | Medium | 6.6 | 2025-02-03 | Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors. |
CVE-2024-38411 | Medium | 6.6 | 2025-02-03 | Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls. |
CVE-2024-38404 | High | 7.5 | 2025-02-03 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem. |
CVE-2024-50500 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Cont… |