2024 CVEs (page 4)
Page 4 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42718 | Medium | 6.5 | 2025-12-26 | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter. |
CVE-2024-29720 | Medium | 5.5 | 2025-12-26 | An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter vide… |
CVE-2024-40317 | Medium | 6.1 | 2025-12-24 | A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via in… |
CVE-2024-39037 | Medium | 6.5 | 2025-12-24 | MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter. |
CVE-2024-35322 | Medium | 6.1 | 2025-12-24 | MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. |
CVE-2024-58335 | Medium | 5.0 | 2025-12-24 | OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImp… |
CVE-2024-57521 | Critical | 10.0 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java. |
CVE-2024-9684 | High | 7.5 | 2025-12-23 | FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences. |
CVE-2024-24844 | High | 7.5 | 2025-12-23 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-27708 | Critical | 9.6 | 2025-12-22 | Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src pa… |
CVE-2024-25812 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter. |
CVE-2024-35321 | Medium | 4.3 | 2025-12-22 | MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. |
CVE-2024-25814 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter. |
CVE-2024-49587 | Critical | 9.1 | 2025-12-19 | Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit gl… |
CVE-2024-58323 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows mali… |
CVE-2024-58322 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead… |
CVE-2024-58321 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers… |
CVE-2024-58320 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentic… |
CVE-2024-58319 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration d… |
CVE-2024-58318 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and f… |
CVE-2024-58317 | Medium | 5.3 | 2025-12-18 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.conf… |
CVE-2024-46062 | High | 7.8 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During instal… |
CVE-2024-46060 | High | 7.8 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install… |
CVE-2024-29371 | High | 7.5 | 2025-12-17 | In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally… |
CVE-2024-29370 | Medium | 5.3 | 2025-12-17 | In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON W… |
CVE-2024-44599 | High | 8.3 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Directory Traversal. |
CVE-2024-44598 | High | 8.8 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. |
CVE-2024-58316 | High | 7.5 | 2025-12-12 | Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL thro… |
CVE-2024-58314 | High | 8.8 | 2025-12-12 | Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attacke… |
CVE-2024-58311 | Critical | 9.8 | 2025-12-12 | Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier… |
CVE-2024-58305 | High | 8.8 | 2025-12-12 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. At… |
CVE-2024-58299 | Critical | 9.8 | 2025-12-12 | PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a… |
CVE-2024-14010 | Critical | 9.8 | 2025-12-12 | Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can… |
CVE-2024-58313 | High | 7.2 | 2025-12-11 | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrar… |
CVE-2024-58312 | High | 7.5 | 2025-12-11 | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. A… |
CVE-2024-58310 | | 2025-12-11 | APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating UR… | |
CVE-2024-58309 | Critical | 9.8 | 2025-12-11 | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL c… |
CVE-2024-58308 | Critical | 9.8 | 2025-12-11 | Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attac… |
CVE-2024-58307 | High | 8.8 | 2025-12-11 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database… |
CVE-2024-58306 | | 2025-12-11 | minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can… | |
CVE-2024-58304 | High | 7.5 | 2025-12-11 | SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inje… |
CVE-2024-58303 | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. A… | |
CVE-2024-58302 | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Atta… | |
CVE-2024-58301 | | 2025-12-11 | Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parame… | |
CVE-2024-58300 | | 2025-12-11 | Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated cre… | |
CVE-2024-58298 | | 2025-12-11 | Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP fil… | |
CVE-2024-58297 | Medium | 5.4 | 2025-12-11 | PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Att… |
CVE-2024-58296 | | 2025-12-11 | CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts… | |
CVE-2024-58295 | | 2025-12-11 | ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme ins… | |
CVE-2024-58294 | High | 8.8 | 2025-12-11 | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbi… |
CVE-2024-58293 | | 2025-12-11 | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple fo… | |
CVE-2024-58292 | | 2025-12-11 | XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templ… | |
CVE-2024-58291 | | 2025-12-11 | Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fi… | |
CVE-2024-58290 | | 2025-12-11 | Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through… | |
CVE-2024-58289 | Medium | 5.4 | 2025-12-11 | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields… |
CVE-2024-58288 | | 2025-12-11 | Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit t… | |
CVE-2024-58287 | High | 8.8 | 2025-12-11 | reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute… |
CVE-2024-58286 | | 2025-12-11 | dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. A… | |
CVE-2024-42197 | Medium | 5.5 | 2025-12-11 | HCL Workload Scheduler stores user credentials in plain text which can be read by a local user. |
CVE-2024-8273 | High | 8.8 | 2025-12-11 | Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1. |
CVE-2024-40593 | Medium | 6.0 | 2025-12-11 | A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAn… |
CVE-2024-58285 | Medium | 5.4 | 2025-12-10 | Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can cr… |
CVE-2024-58284 | High | 7.2 | 2025-12-10 | PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the meta… |
CVE-2024-58283 | High | 8.8 | 2025-12-10 | WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder fi… |
CVE-2024-58282 | High | 7.2 | 2025-12-10 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploa… |
CVE-2024-58281 | High | 8.8 | 2025-12-10 | Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functio… |
CVE-2024-58280 | High | 8.8 | 2025-12-10 | CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. A… |
CVE-2024-58279 | High | 8.8 | 2025-12-10 | appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the file… |
CVE-2024-2105 | Medium | 6.5 | 2025-12-10 | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices. |
CVE-2024-2104 | High | 8.8 | 2025-12-10 | Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands throug… |
CVE-2024-47570 | Medium | 6.6 | 2025-12-09 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7… |
CVE-2024-56840 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56839 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56838 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56837 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56836 | High | 7.5 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56835 | High | 8.8 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56464 | Low | 2.7 | 2025-12-09 | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed thi… |
CVE-2024-38798 | | 2025-12-09 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful expl… | |
CVE-2024-9183 | High | 7.7 | 2025-12-05 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have… |
CVE-2024-58278 | | 2025-12-04 | perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can co… | |
CVE-2024-58277 | | 2025-12-04 | R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authenticati… | |
CVE-2024-58276 | | 2025-12-04 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execut… | |
CVE-2024-58275 | | 2025-12-04 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter in… | |
CVE-2024-5401 | Medium | 4.3 | 2025-12-04 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-6… |
CVE-2024-45539 | High | 7.5 | 2025-12-04 | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller… |
CVE-2024-45538 | Critical | 9.6 | 2025-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Uni… |
CVE-2024-3884 | High | 7.5 | 2025-12-03 | A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) m… |
CVE-2024-32643 | High | 7.5 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ dec… |
CVE-2024-32642 | High | 8.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows… |
CVE-2024-32641 | Critical | 9.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution… |
CVE-2024-45675 | High | 8.4 | 2025-12-02 | IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password. |
CVE-2024-53684 | High | 7.5 | 2025-12-01 | A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request… |
CVE-2024-49572 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-48894 | Medium | 5.9 | 2025-12-01 | A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to… |
CVE-2024-48882 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-45370 | High | 7.3 | 2025-12-01 | An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database… |
CVE-2024-39148 | High | 8.1 | 2025-12-01 | The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS… |
CVE-2024-32388 | Medium | 5.3 | 2025-12-01 | Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to by… |
CVE-2024-32384 | Medium | 6.8 | 2025-12-01 | Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer secu… |