2024 CVEs (page 40)
Page 40 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54499 | High | 8.8 | 2025-01-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS… |
CVE-2024-54497 | Medium | 6.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2, macOS Sonoma 14.7.3, macOS Ve… |
CVE-2024-54488 | Medium | 5.3 | 2025-01-27 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7… |
CVE-2024-54478 | Medium | 6.5 | 2025-01-27 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2… |
CVE-2024-54475 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventu… |
CVE-2024-54468 | High | 8.2 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ve… |
CVE-2024-44172 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.3, macOS Ventura… |
CVE-2024-37526 | Medium | 6.5 | 2025-01-27 | IBM Watson Query on Cloud Pak for Data (IBM Data Virtualization 1.8, 2.0, 2.1, 2.2, and 3.0.0) could allow an authenticated user to obtain sensitive informatio… |
CVE-2024-48841 | Critical | 10.0 | 2025-01-27 | Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older. |
CVE-2024-56972 | Medium | 6.5 | 2025-01-27 | An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56971 | Medium | 6.5 | 2025-01-27 | An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information vi… |
CVE-2024-56969 | Medium | 6.5 | 2025-01-27 | An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56968 | Medium | 6.5 | 2025-01-27 | An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. |
CVE-2024-56967 | Medium | 6.5 | 2025-01-27 | An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56966 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information… |
CVE-2024-56965 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted lin… |
CVE-2024-56964 | Medium | 6.5 | 2025-01-27 | An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplyin… |
CVE-2024-56963 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted… |
CVE-2024-56962 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56960 | Medium | 6.5 | 2025-01-27 | An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56959 | Medium | 6.5 | 2025-01-27 | An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56957 | Medium | 6.5 | 2025-01-27 | An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted l… |
CVE-2024-56955 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56954 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56953 | Medium | 6.5 | 2025-01-27 | An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. |
CVE-2024-56952 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a cr… |
CVE-2024-56951 | Medium | 6.5 | 2025-01-27 | An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56950 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56949 | Medium | 6.5 | 2025-01-27 | An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying… |
CVE-2024-56948 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56947 | Medium | 6.5 | 2025-01-27 | An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-26317 | Medium | 6.1 | 2025-01-27 | In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the alg… |
CVE-2024-12740 | High | 7.8 | 2025-01-27 | Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbi… |
CVE-2024-57276 | High | 7.3 | 2025-01-27 | In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. This service is configured with insecure… |
CVE-2024-57272 | Medium | 6.1 | 2025-01-27 | SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower is vulnerable to Cross Site Scripting (XSS). |
CVE-2024-55228 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a craft… |
CVE-2024-55227 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a… |
CVE-2024-54146 | High | 7.6 | 2025-01-27 | Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php usin… |
CVE-2024-54145 | Medium | 6.3 | 2025-01-27 | Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation… |
CVE-2024-48420 | High | 8.8 | 2025-01-27 | Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic. |
CVE-2024-48419 | High | 8.8 | 2025-01-27 | Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered throug… |
CVE-2024-48418 | High | 8.8 | 2025-01-27 | In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided p… |
CVE-2024-48417 | Medium | 5.2 | 2025-01-27 | Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRoute, /goform/fromSet… |
CVE-2024-48416 | High | 8.8 | 2025-01-27 | Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding. |
CVE-2024-27256 | Medium | 5.9 | 2025-01-27 | IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weak… |
CVE-2024-45598 | Medium | 6.0 | 2025-01-27 | Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter… |
CVE-2024-38325 | Medium | 5.9 | 2025-01-27 | IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending net… |
CVE-2024-38320 | Medium | 5.9 | 2025-01-27 | IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than ex… |
CVE-2024-37527 | Medium | 5.4 | 2025-01-27 | IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code… |
CVE-2024-22316 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user… |
CVE-2024-57595 | Critical | 9.8 | 2025-01-27 | DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc_client_pin.cgi, which allows remote attackers to execute ar… |
CVE-2024-57590 | Critical | 9.8 | 2025-01-27 | TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute a… |
CVE-2024-11348 | | 2025-01-27 | Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoi… | |
CVE-2024-55931 | Medium | 6.5 | 2025-01-27 | Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vuln… |
CVE-2024-12345 | Medium | 4.4 | 2025-01-27 | A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx o… |
CVE-2024-52012 | Medium | 5.4 | 2025-01-27 | Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of in… |
CVE-2024-43446 | Low | 3.5 | 2025-01-27 | An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. … |
CVE-2024-43445 | Medium | 5.4 | 2025-01-27 | A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could ex… |
CVE-2024-13117 | Medium | 6.5 | 2025-01-27 | The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded |
CVE-2024-13116 | Low | 3.8 | 2025-01-27 | The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-13095 | Medium | 4.8 | 2025-01-27 | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL… |
CVE-2024-13094 | High | 7.1 | 2025-01-27 | The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-13057 | High | 7.1 | 2025-01-27 | The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-13056 | High | 7.1 | 2025-01-27 | The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13055 | High | 7.1 | 2025-01-27 | The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13052 | High | 7.1 | 2025-01-27 | The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading… |
CVE-2024-12774 | Medium | 6.5 | 2025-01-27 | The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrar… |
CVE-2024-12773 | High | 7.2 | 2025-01-27 | The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL in… |
CVE-2024-12436 | Medium | 4.3 | 2025-01-27 | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwan… |
CVE-2024-12321 | High | 7.1 | 2025-01-27 | The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-12280 | Medium | 4.3 | 2025-01-27 | The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in t… |
CVE-2024-28771 | Medium | 4.8 | 2025-01-27 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessio… |
CVE-2024-28770 | Medium | 4.8 | 2025-01-27 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessio… |
CVE-2024-28766 | Low | 2.4 | 2025-01-27 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that… |
CVE-2024-31906 | Medium | 6.2 | 2025-01-26 | IBM Automation Decision Services 23.0.2 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2024-13505 | Medium | 5.5 | 2025-01-26 | The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up… |
CVE-2024-12334 | Medium | 6.1 | 2025-01-26 | The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versio… |
CVE-2024-11936 | High | 8.8 | 2025-01-26 | The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on… |
CVE-2024-11641 | High | 8.8 | 2025-01-26 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is… |
CVE-2024-46881 | High | 7.1 | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise C… |
CVE-2024-11090 | Medium | 5.3 | 2025-01-26 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via… |
CVE-2024-10705 | Medium | 5.4 | 2025-01-26 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the… |
CVE-2024-10636 | Medium | 6.1 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all version… |
CVE-2024-10633 | High | 7.3 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0… |
CVE-2024-10628 | High | 7.5 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including… |
CVE-2024-10574 | High | 7.2 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-35150 | Medium | 5.3 | 2025-01-25 | IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an att… |
CVE-2024-35148 | Medium | 6.3 | 2025-01-25 | IBM Maximo Application Suite 8.10.10, 8.11.7, and 9.0 - Monitor Component is vulnerable to SQL injection. A remote attacker could send specially crafted SQL st… |
CVE-2024-35145 | Medium | 6.1 | 2025-01-25 | IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed ar… |
CVE-2024-35144 | Medium | 5.3 | 2025-01-25 | IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system. |
CVE-2024-39750 | High | 8.8 | 2025-01-25 | IBM Analytics Content Hub 2.0 is vulnerable to a buffer overflow due to improper return length checking. A remote authenticated attacker could overflow a buffe… |
CVE-2024-35134 | Medium | 5.3 | 2025-01-25 | IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2024-35114 | Medium | 5.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2024-35113 | Medium | 4.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow an authenticated user to obtain sensitive information exposed through a directory listing. |
CVE-2024-35112 | Medium | 5.4 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2024-35111 | Medium | 4.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2024-13562 | High | 7.5 | 2025-01-25 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2024-13450 | Low | 3.8 | 2025-01-25 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-13449 | Medium | 4.3 | 2025-01-25 | The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_action' function in al… |
CVE-2024-13599 | Medium | 6.4 | 2025-01-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to in… |