2024 CVEs (page 39)
Page 39 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48852 | Critical | 9.4 | 2025-01-29 | Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This i… |
CVE-2024-48849 | Critical | 9.4 | 2025-01-29 | Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affec… |
CVE-2024-10001 | High | 7.1 | 2025-01-29 | A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the ident… |
CVE-2024-57439 | Medium | 4.9 | 2025-01-29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login nam… |
CVE-2024-57438 | Medium | 5.4 | 2025-01-29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. |
CVE-2024-57437 | Medium | 6.5 | 2025-01-29 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list. |
CVE-2024-57436 | High | 7.2 | 2025-01-29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to imp… |
CVE-2024-54462 | High | 7.1 | 2025-01-29 | The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in case… |
CVE-2024-54461 | High | 7.1 | 2025-01-29 | The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cas… |
CVE-2024-41140 | High | 8.1 | 2025-01-29 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. |
CVE-2024-13561 | Medium | 6.4 | 2025-01-29 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's brid_override_yt shortcode in all versions up… |
CVE-2024-57965 | Unrated | | 2025-01-29 | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href'… |
CVE-2024-7695 | High | 7.5 | 2025-01-29 | Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be… |
CVE-2024-13696 | High | 7.2 | 2025-01-29 | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist… |
CVE-2024-12749 | High | 7.1 | 2025-01-29 | The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-57519 | High | 7.5 | 2025-01-28 | An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file. |
CVE-2024-56529 | High | 7.1 | 2025-01-28 | Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on… |
CVE-2024-48310 | High | 7.5 | 2025-01-28 | AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backen… |
CVE-2024-57514 | Medium | 4.8 | 2025-01-28 | The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a s… |
CVE-2024-57376 | High | 8.8 | 2025-01-28 | Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticated users to execut… |
CVE-2024-55968 | High | 8.8 | 2025-01-28 | An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the mac… |
CVE-2024-29869 | Medium | 5.5 | 2025-01-28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A… |
CVE-2024-40677 | High | 8.4 | 2025-01-28 | In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. Thi… |
CVE-2024-40676 | High | 7.7 | 2025-01-28 | In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. T… |
CVE-2024-40675 | High | 7.5 | 2025-01-28 | In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no addi… |
CVE-2024-40674 | Medium | 5.3 | 2025-01-28 | In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lea… |
CVE-2024-40673 | Medium | 6.5 | 2025-01-28 | In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validat… |
CVE-2024-40672 | High | 8.4 | 2025-01-28 | In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local es… |
CVE-2024-40670 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-40669 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-40651 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no addi… |
CVE-2024-40649 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no addi… |
CVE-2024-34748 | High | 8.4 | 2025-01-28 | In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. This could lead to local escalation of pri… |
CVE-2024-34733 | High | 8.4 | 2025-01-28 | In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of pr… |
CVE-2024-34732 | High | 8.4 | 2025-01-28 | In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in… |
CVE-2024-13484 | High | 8.2 | 2025-01-28 | A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instan… |
CVE-2024-8401 | Medium | 5.4 | 2025-01-28 | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folde… |
CVE-2024-7881 | Medium | 5.1 | 2025-01-28 | An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an add… |
CVE-2024-6351 | Medium | 4.3 | 2025-01-28 | A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert |
CVE-2024-11956 | Medium | 4.7 | 2025-01-28 | A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functi… |
CVE-2024-11954 | Low | 2.4 | 2025-01-28 | A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Docum… |
CVE-2024-23953 | Medium | 6.5 | 2025-01-28 | Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte… |
CVE-2024-13527 | Medium | 6.4 | 2025-01-28 | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in a… |
CVE-2024-13521 | Medium | 6.1 | 2025-01-28 | The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missi… |
CVE-2024-13509 | High | 7.2 | 2025-01-28 | The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.1… |
CVE-2024-13448 | Critical | 9.8 | 2025-01-28 | The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' func… |
CVE-2024-12807 | Medium | 4.8 | 2025-01-28 | The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-12723 | Medium | 6.1 | 2025-01-28 | The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-11135 | High | 7.5 | 2025-01-28 | The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and in… |
CVE-2024-53881 | Medium | 5.5 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial… |
CVE-2024-53869 | Medium | 5.5 | 2025-01-28 | NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability m… |
CVE-2024-0150 | High | 7.1 | 2025-01-28 | NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful e… |
CVE-2024-0149 | Low | 3.3 | 2025-01-28 | NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerabi… |
CVE-2024-0147 | Medium | 5.5 | 2025-01-28 | NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data… |
CVE-2024-0146 | High | 7.8 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this v… |
CVE-2024-0140 | Medium | 6.8 | 2025-01-28 | NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulne… |
CVE-2024-0137 | Medium | 5.5 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the hos… |
CVE-2024-0136 | High | 7.6 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and… |
CVE-2024-0135 | High | 7.6 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A… |
CVE-2024-45341 | Medium | 6.1 | 2025-01-28 | A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certifica… |
CVE-2024-45340 | High | 8.8 | 2025-01-28 | Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not… |
CVE-2024-45339 | High | 7.1 | 2025-01-28 | When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a… |
CVE-2024-45336 | Medium | 6.1 | 2025-01-28 | The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is r… |
CVE-2024-22315 | Medium | 4.0 | 2025-01-28 | IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container t… |
CVE-2024-27263 | Medium | 5.3 | 2025-01-28 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dash… |
CVE-2024-12649 | Critical | 9.8 | 2025-01-28 | Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2024-12648 | Critical | 9.8 | 2025-01-28 | Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-12647 | Critical | 9.8 | 2025-01-28 | Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-28786 | Medium | 6.5 | 2025-01-28 | IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using… |
CVE-2024-57549 | High | 7.5 | 2025-01-27 | CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. |
CVE-2024-57548 | Critical | 9.1 | 2025-01-27 | CMSimple 5.16 allows the user to edit log.php file via print page. |
CVE-2024-57547 | High | 7.5 | 2025-01-27 | Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of dow… |
CVE-2024-57546 | High | 7.5 | 2025-01-27 | An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. |
CVE-2024-57373 | High | 8.1 | 2025-01-27 | Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of an authenticated u… |
CVE-2024-57052 | Critical | 9.8 | 2025-01-27 | An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. |
CVE-2024-56316 | High | 7.5 | 2025-01-27 | In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent De… |
CVE-2024-56178 | Medium | 6.5 | 2025-01-27 | An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin… |
CVE-2024-54728 | Medium | 6.5 | 2025-01-27 | Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. |
CVE-2024-48662 | Medium | 6.1 | 2025-01-27 | Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the… |
CVE-2024-54557 | High | 7.5 | 2025-01-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may g… |
CVE-2024-54550 | Medium | 4.0 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An app may be a… |
CVE-2024-54549 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensiti… |
CVE-2024-54547 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-54543 | High | 8.8 | 2025-01-27 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18… |
CVE-2024-54542 | Critical | 9.1 | 2025-01-27 | An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS… |
CVE-2024-54541 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ven… |
CVE-2024-54539 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be… |
CVE-2024-54537 | High | 8.2 | 2025-01-27 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may b… |
CVE-2024-54536 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.2. An app may be able to edit NVRAM variable… |
CVE-2024-54530 | Critical | 9.1 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, watchOS 11.2. Password autofil… |
CVE-2024-54523 | Medium | 6.3 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54522 | High | 7.8 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54520 | Medium | 5.5 | 2025-01-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may… |
CVE-2024-54519 | Medium | 5.5 | 2025-01-27 | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read sensitive location inf… |
CVE-2024-54518 | Medium | 5.3 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54517 | High | 7.8 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54516 | Low | 3.3 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to approve a… |
CVE-2024-54512 | Critical | 9.1 | 2025-01-27 | The issue was addressed by removing the relevant flags. This issue is fixed in iOS 18.2 and iPadOS 18.2, watchOS 11.2. A system binary could be used to fingerp… |
CVE-2024-54509 | High | 7.8 | 2025-01-27 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Sonoma 14.7.3… |
CVE-2024-54507 | Medium | 5.5 | 2025-01-27 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An attacker with user… |