2024 CVEs (page 36)
Page 36 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13327 | Medium | 6.1 | 2025-02-04 | The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13326 | Medium | 6.1 | 2025-02-04 | The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13325 | Medium | 6.1 | 2025-02-04 | The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2024-13115 | Medium | 6.1 | 2025-02-04 | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as… |
CVE-2024-13114 | Medium | 6.1 | 2025-02-04 | The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2024-47770 | Medium | 4.6 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-35177 | High | 7.8 | 2025-02-03 | Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtual… |
CVE-2024-57451 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory. |
CVE-2024-56903 | High | 8.1 | 2025-02-03 | Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as accou… |
CVE-2024-56902 | High | 7.5 | 2025-02-03 | Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includin… |
CVE-2024-56901 | High | 8.8 | 2025-02-03 | A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily creat… |
CVE-2024-56898 | High | 8.8 | 2025-02-03 | Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that the… |
CVE-2024-44449 | Medium | 6.1 | 2025-02-03 | Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login… |
CVE-2024-34897 | High | 7.5 | 2025-02-03 | Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability. |
CVE-2024-34896 | High | 7.5 | 2025-02-03 | An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection… |
CVE-2024-57968 | Critical | 9.9 | 2025-02-03 | Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsin… |
CVE-2024-57669 | High | 7.5 | 2025-02-03 | Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java… |
CVE-2024-57498 | Medium | 4.8 | 2025-02-03 | Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function. |
CVE-2024-57452 | High | 7.5 | 2025-02-03 | ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder. |
CVE-2024-57450 | Critical | 9.8 | 2025-02-03 | ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. |
CVE-2024-57099 | Critical | 9.8 | 2025-02-03 | ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model ma… |
CVE-2024-57098 | Critical | 9.8 | 2025-02-03 | Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter. |
CVE-2024-57097 | Medium | 4.8 | 2025-02-03 | ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php. |
CVE-2024-56946 | Medium | 5.3 | 2025-02-03 | Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC… |
CVE-2024-56921 | High | 7.5 | 2025-02-03 | An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_… |
CVE-2024-12859 | High | 8.8 | 2025-02-03 | The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' s… |
CVE-2024-12511 | High | 7.6 | 2025-02-03 | With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pr… |
CVE-2024-11134 | Medium | 4.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function i… |
CVE-2024-11133 | Medium | 5.3 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function i… |
CVE-2024-11132 | Medium | 6.4 | 2025-02-03 | The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient inpu… |
CVE-2024-57238 | High | 7.3 | 2025-02-03 | Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allows an attacker to man… |
CVE-2024-57237 | Medium | 6.3 | 2025-02-03 | Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerability arises because… |
CVE-2024-57004 | Medium | 6.1 | 2025-02-03 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadin… |
CVE-2024-50656 | Medium | 6.1 | 2025-02-03 | itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. |
CVE-2024-12510 | Medium | 6.7 | 2025-02-03 | If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active… |
CVE-2024-57967 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mapping. |
CVE-2024-57175 | Medium | 5.4 | 2025-02-03 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name to /user/certifica… |
CVE-2024-56161 | High | 7.2 | 2025-02-03 | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode… |
CVE-2024-54840 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute… |
CVE-2024-53943 | Medium | 6.1 | 2025-02-03 | An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz… |
CVE-2024-53942 | Medium | 4.8 | 2025-02-03 | An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4… |
CVE-2024-36437 | Medium | 6.5 | 2025-02-03 | The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions)… |
CVE-2024-55456 | Medium | 6.5 | 2025-02-03 | lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell |
CVE-2024-49843 | High | 7.8 | 2025-02-03 | Memory corruption while processing IOCTL from user space to handle GPU AHB bus error. |
CVE-2024-49840 | High | 7.8 | 2025-02-03 | Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality. |
CVE-2024-49839 | High | 8.2 | 2025-02-03 | Memory corruption during management frame processing due to mismatch in T2LM info element. |
CVE-2024-49838 | High | 8.2 | 2025-02-03 | Information disclosure while parsing the OCI IE with invalid length. |
CVE-2024-49837 | High | 7.8 | 2025-02-03 | Memory corruption while reading CPU state data during guest VM suspend. |
CVE-2024-49834 | High | 7.8 | 2025-02-03 | Memory corruption while power-up or power-down sequence of the camera sensor. |
CVE-2024-49833 | High | 7.8 | 2025-02-03 | Memory corruption can occur in the camera when an invalid CID is used. |
CVE-2024-49832 | High | 7.8 | 2025-02-03 | Memory corruption in Camera due to unusually high number of nodes passed to AXI port. |
CVE-2024-45584 | High | 7.8 | 2025-02-03 | Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace. |
CVE-2024-45582 | High | 7.8 | 2025-02-03 | Memory corruption while validating number of devices in Camera kernel . |
CVE-2024-45573 | High | 7.8 | 2025-02-03 | Memory corruption may occour while generating test pattern due to negative indexing of display ID. |
CVE-2024-45571 | High | 7.8 | 2025-02-03 | Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface. |
CVE-2024-45569 | Critical | 9.8 | 2025-02-03 | Memory corruption while parsing the ML IE due to invalid frame content. |
CVE-2024-45561 | High | 7.8 | 2025-02-03 | Memory corruption while handling IOCTL call from user-space to set latency level. |
CVE-2024-45560 | High | 7.8 | 2025-02-03 | Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer. |
CVE-2024-38420 | High | 8.8 | 2025-02-03 | Memory corruption while configuring a Hypervisor based input virtual device. |
CVE-2024-38418 | High | 7.8 | 2025-02-03 | Memory corruption while parsing the memory map info in IOCTL calls. |
CVE-2024-38417 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing IO control commands. |
CVE-2024-38416 | Medium | 6.1 | 2025-02-03 | Information disclosure during audio playback. |
CVE-2024-38414 | Medium | 6.1 | 2025-02-03 | Information disclosure while processing information on firmware image during core initialization. |
CVE-2024-38413 | Medium | 6.6 | 2025-02-03 | Memory corruption while processing frame packets. |
CVE-2024-38412 | Medium | 6.6 | 2025-02-03 | Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors. |
CVE-2024-38411 | Medium | 6.6 | 2025-02-03 | Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls. |
CVE-2024-38404 | High | 7.5 | 2025-02-03 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem. |
CVE-2024-50500 | Medium | 4.3 | 2025-02-03 | Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Cont… |
CVE-2024-43333 | High | 7.5 | 2025-02-03 | Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site E… |
CVE-2024-57522 | Medium | 6.4 | 2025-02-03 | SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a malicious script in… |
CVE-2024-6790 | Medium | 6.1 | 2025-02-03 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th G… |
CVE-2024-10395 | High | 8.6 | 2025-02-03 | No proper validation of the length of user input in http_server_get_content_type_from_extension. |
CVE-2024-13347 | Medium | 6.8 | 2025-02-03 | The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Sit… |
CVE-2024-57966 | Medium | 5.0 | 2025-02-03 | libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive. |
CVE-2024-20147 | Medium | 5.3 | 2025-02-03 | In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service with no additional exe… |
CVE-2024-20142 | Medium | 6.6 | 2025-02-03 | In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20141 | Medium | 6.6 | 2025-02-03 | In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-0131 | Medium | 4.4 | 2025-02-02 | NVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read a buffer with an incorrect length. A s… |
CVE-2024-13775 | Medium | 5.4 | 2025-02-01 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_… |
CVE-2024-13612 | Medium | 6.4 | 2025-02-01 | The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-13429 | Medium | 4.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-13428 | Medium | 5.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-13425 | Medium | 4.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-13372 | Medium | 5.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-13371 | Medium | 5.3 | 2025-02-01 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending… |
CVE-2024-12825 | Medium | 5.4 | 2025-02-01 | The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actio… |
CVE-2024-13341 | Medium | 6.5 | 2025-02-01 | The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all version… |
CVE-2024-11829 | Medium | 6.4 | 2025-02-01 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-13099 | Medium | 5.4 | 2025-02-01 | The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13098 | Medium | 5.4 | 2025-02-01 | The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2024-13097 | Medium | 5.4 | 2025-02-01 | The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13096 | Medium | 4.6 | 2025-02-01 | The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-12768 | Medium | 5.4 | 2025-02-01 | The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where th… |
CVE-2024-12041 | Medium | 5.3 | 2025-02-01 | The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all… |
CVE-2024-53295 | High | 7.8 | 2025-02-01 | Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low priv… |
CVE-2024-53296 | Low | 2.7 | 2025-02-01 | Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. A high privileged attacker w… |
CVE-2024-51534 | High | 7.1 | 2025-02-01 | Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially… |
CVE-2024-13651 | Medium | 4.3 | 2025-02-01 | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-13547 | Medium | 6.4 | 2025-02-01 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and in… |
CVE-2024-13343 | High | 8.8 | 2025-02-01 | The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() f… |