2024 CVEs (page 41)
Page 41 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56404 | Critical | 9.9 | 2025-01-24 | In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa… |
CVE-2024-35122 | Low | 2.8 | 2025-01-24 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user… |
CVE-2024-45077 | Medium | 6.5 | 2025-01-24 | IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricte… |
CVE-2024-41757 | Medium | 5.9 | 2025-01-24 | IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2024-40706 | Medium | 5.3 | 2025-01-24 | IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system. |
CVE-2024-40693 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attack… |
CVE-2024-25034 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers ca… |
CVE-2024-13698 | Medium | 6.5 | 2025-01-24 | The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'do… |
CVE-2024-9499 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary… |
CVE-2024-9498 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9497 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary cod… |
CVE-2024-9496 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9495 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary co… |
CVE-2024-9494 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9493 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code executi… |
CVE-2024-9492 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9491 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code ex… |
CVE-2024-9490 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code… |
CVE-2024-57184 | Medium | 5.5 | 2025-01-24 | An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163… |
CVE-2024-41739 | High | 8.8 | 2025-01-24 | IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion. |
CVE-2024-11913 | Medium | 5.4 | 2025-01-24 | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 v… |
CVE-2024-10324 | Medium | 4.3 | 2025-01-24 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the registe… |
CVE-2024-13594 | Medium | 6.5 | 2025-01-24 | The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to… |
CVE-2024-13572 | Medium | 6.4 | 2025-01-24 | The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortc… |
CVE-2024-13542 | Medium | 6.4 | 2025-01-24 | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-13409 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13408 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13354 | Medium | 6.4 | 2025-01-24 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2024-13335 | Medium | 4.3 | 2025-01-24 | The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… |
CVE-2024-13583 | Medium | 6.4 | 2025-01-24 | The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to… |
CVE-2024-12494 | Medium | 6.4 | 2025-01-24 | The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all versions up to, and… |
CVE-2024-13545 | Critical | 9.8 | 2025-01-24 | The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes… |
CVE-2024-13683 | Medium | 4.3 | 2025-01-24 | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to… |
CVE-2024-13680 | Medium | 6.5 | 2025-01-24 | The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions… |
CVE-2024-13659 | Medium | 6.4 | 2025-01-24 | The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions up to, and including… |
CVE-2024-11931 | Medium | 6.4 | 2025-01-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8… |
CVE-2024-55573 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with… |
CVE-2024-53379 | High | 7.5 | 2025-01-23 | Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee011… |
CVE-2024-57556 | Medium | 6.1 | 2025-01-23 | Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep.js component |
CVE-2024-57386 | Medium | 6.1 | 2025-01-23 | Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function. |
CVE-2024-57329 | Medium | 5.4 | 2025-01-23 | HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attacker… |
CVE-2024-57328 | Critical | 9.8 | 2025-01-23 | A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and pass… |
CVE-2024-57326 | Medium | 6.1 | 2025-01-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacke… |
CVE-2024-55195 | High | 7.5 | 2025-01-23 | An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to al… |
CVE-2024-55194 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h. |
CVE-2024-55193 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h. |
CVE-2024-55192 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*). |
CVE-2024-53923 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high priv… |
CVE-2024-53588 | High | 7.8 | 2025-01-23 | A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\D… |
CVE-2024-50665 | Medium | 5.5 | 2025-01-23 | gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box. |
CVE-2024-50664 | High | 7.8 | 2025-01-23 | gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box. |
CVE-2024-55930 | Medium | 6.7 | 2025-01-23 | Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files |
CVE-2024-55929 | Medium | 5.3 | 2025-01-23 | A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourc… |
CVE-2024-55928 | Medium | 6.5 | 2025-01-23 | Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wi… |
CVE-2024-55927 | High | 7.6 | 2025-01-23 | A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or for… |
CVE-2024-55926 | High | 7.6 | 2025-01-23 | A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploitin… |
CVE-2024-45672 | Medium | 6.0 | 2025-01-23 | IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which… |
CVE-2024-55925 | High | 7.5 | 2025-01-23 | In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the… |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-52330 | High | 7.4 | 2025-01-23 | ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmwa… |
CVE-2024-52329 | High | 7.4 | 2025-01-23 | ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and o… |
CVE-2024-52328 | Low | 2.3 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can d… |
CVE-2024-52327 | Medium | 6.5 | 2025-01-23 | The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed. |
CVE-2024-12079 | Low | 3.3 | 2025-01-23 | ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-th… |
CVE-2024-12078 | Medium | 6.3 | 2025-01-23 | ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control an… |
CVE-2024-11147 | High | 7.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as r… |
CVE-2024-55971 | Critical | 10.0 | 2025-01-23 | SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to run arbitrary code on… |
CVE-2024-52325 | Critical | 9.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. |
CVE-2024-10846 | Medium | 5.9 | 2025-01-23 | The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excess… |
CVE-2024-57947 | Critical | 9.8 | 2025-01-23 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all… |
CVE-2024-10539 | Medium | 5.5 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XS… |
CVE-2024-13422 | Medium | 6.1 | 2025-01-23 | The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in al… |
CVE-2024-13389 | Medium | 6.4 | 2025-01-23 | The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all versions up to, and i… |
CVE-2024-13340 | Medium | 6.4 | 2025-01-23 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode i… |
CVE-2024-13236 | Medium | 6.5 | 2025-01-23 | The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insuffi… |
CVE-2024-12504 | Medium | 6.4 | 2025-01-23 | The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '… |
CVE-2024-12118 | Medium | 6.4 | 2025-01-23 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in… |
CVE-2024-43708 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI… |
CVE-2024-13234 | High | 7.5 | 2025-01-23 | The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1… |
CVE-2024-12043 | Medium | 6.4 | 2025-01-23 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cr… |
CVE-2024-13593 | High | 7.5 | 2025-01-23 | The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcod… |
CVE-2024-13511 | Medium | 4.3 | 2025-01-23 | The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in… |
CVE-2024-12957 | | 2025-01-23 | A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for… | |
CVE-2024-53299 | Medium | 6.5 | 2025-01-23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are… |
CVE-2024-52975 | Critical | 9.0 | 2025-01-23 | An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of t… |
CVE-2024-52972 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can… |
CVE-2024-43710 | Medium | 4.3 | 2025-01-23 | A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints… |
CVE-2024-43707 | High | 7.7 | 2025-01-23 | An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of… |
CVE-2024-42187 | Medium | 5.3 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository w… |
CVE-2024-42186 | Low | 2.8 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation. |
CVE-2024-42185 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vuln… |
CVE-2024-42184 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using th… |
CVE-2024-42183 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary… |
CVE-2024-57724 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. |
CVE-2024-57723 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. |
CVE-2024-57722 | High | 7.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create. |
CVE-2024-57721 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. |
CVE-2024-57720 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. |
CVE-2024-57719 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. |
CVE-2024-42182 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an intern… |