2024 CVEs (page 42)
Page 42 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10846 | Medium | 5.9 | 2025-01-23 | The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excess… |
CVE-2024-57947 | Critical | 9.8 | 2025-01-23 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all… |
CVE-2024-10539 | Medium | 5.5 | 2025-01-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XS… |
CVE-2024-13422 | Medium | 6.1 | 2025-01-23 | The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in al… |
CVE-2024-13389 | Medium | 6.4 | 2025-01-23 | The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all versions up to, and i… |
CVE-2024-13340 | Medium | 6.4 | 2025-01-23 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode i… |
CVE-2024-13236 | Medium | 6.5 | 2025-01-23 | The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insuffi… |
CVE-2024-12504 | Medium | 6.4 | 2025-01-23 | The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '… |
CVE-2024-12118 | Medium | 6.4 | 2025-01-23 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in… |
CVE-2024-43708 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI… |
CVE-2024-13234 | High | 7.5 | 2025-01-23 | The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1… |
CVE-2024-12043 | Medium | 6.4 | 2025-01-23 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cr… |
CVE-2024-13593 | High | 7.5 | 2025-01-23 | The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcod… |
CVE-2024-13511 | Medium | 4.3 | 2025-01-23 | The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in… |
CVE-2024-12957 | | 2025-01-23 | A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for… | |
CVE-2024-53299 | Medium | 6.5 | 2025-01-23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are… |
CVE-2024-52975 | Critical | 9.0 | 2025-01-23 | An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of t… |
CVE-2024-52972 | Medium | 6.5 | 2025-01-23 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can… |
CVE-2024-43710 | Medium | 4.3 | 2025-01-23 | A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints… |
CVE-2024-43707 | High | 7.7 | 2025-01-23 | An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of… |
CVE-2024-42187 | Medium | 5.3 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository w… |
CVE-2024-42186 | Low | 2.8 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation. |
CVE-2024-42185 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vuln… |
CVE-2024-42184 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using th… |
CVE-2024-42183 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary… |
CVE-2024-57724 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. |
CVE-2024-57723 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. |
CVE-2024-57722 | High | 7.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create. |
CVE-2024-57721 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. |
CVE-2024-57720 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. |
CVE-2024-57719 | Medium | 6.5 | 2025-01-23 | lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. |
CVE-2024-42182 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an intern… |
CVE-2024-12477 | Medium | 6.4 | 2025-01-22 | The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 d… |
CVE-2024-56924 | High | 7.3 | 2025-01-22 | A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the ad… |
CVE-2024-56923 | Medium | 5.4 | 2025-01-22 | Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remot… |
CVE-2024-56914 | Medium | 5.7 | 2025-01-22 | D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp. |
CVE-2024-9310 | | 2025-01-22 | By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted to aircraft targets… | |
CVE-2024-11166 | | 2025-01-22 | For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a ground station and issue a Comm-A Identity… | |
CVE-2024-55957 | High | 7.8 | 2025-01-22 | In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver packages have a local… |
CVE-2024-51457 | Medium | 4.4 | 2025-01-22 | IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2024-55488 | Medium | 6.5 | 2025-01-22 | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE… |
CVE-2024-42013 | Medium | 6.4 | 2025-01-22 | In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows administrative or debu… |
CVE-2024-42012 | Medium | 5.7 | 2025-01-22 | GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user's decrypted clearte… |
CVE-2024-31903 | High | 8.8 | 2025-01-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary co… |
CVE-2024-24429 | High | 8.6 | 2025-01-22 | A reachable assertion in the nas_eps_send_emm_to_esm function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet. |
CVE-2024-10929 | Medium | 5.1 | 2025-01-22 | In certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a weak form… |
CVE-2024-34235 | High | 8.6 | 2025-01-22 | Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a… |
CVE-2024-24432 | Medium | 5.3 | 2025-01-22 | A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
CVE-2024-24430 | High | 7.5 | 2025-01-22 | A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
CVE-2024-13499 | High | 7.3 | 2025-01-22 | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-13496 | High | 7.5 | 2025-01-22 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-13495 | High | 7.3 | 2025-01-22 | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-13447 | Medium | 4.3 | 2025-01-22 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user A… |
CVE-2024-13361 | Medium | 6.3 | 2025-01-22 | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media funct… |
CVE-2024-13360 | Medium | 5.4 | 2025-01-22 | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_tr… |
CVE-2024-13319 | Medium | 6.1 | 2025-01-22 | The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the UR… |
CVE-2024-13406 | Medium | 6.1 | 2025-01-22 | The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and… |
CVE-2024-12857 | Critical | 9.8 | 2025-01-22 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly ver… |
CVE-2024-12117 | Medium | 6.4 | 2025-01-22 | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the Button block i… |
CVE-2024-12879 | Medium | 4.3 | 2025-01-22 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_… |
CVE-2024-11218 | High | 8.6 | 2025-01-22 | A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a mal… |
CVE-2024-13590 | Medium | 6.4 | 2025-01-22 | The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and includi… |
CVE-2024-13584 | Medium | 6.4 | 2025-01-22 | The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_… |
CVE-2024-13426 | Medium | 5.4 | 2025-01-22 | The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the us… |
CVE-2024-13091 | Critical | 9.8 | 2025-01-22 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload… |
CVE-2024-49749 | High | 8.8 | 2025-01-21 | In DGifSlurp of dgif_lib.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional exe… |
CVE-2024-49748 | Critical | 9.8 | 2025-01-21 | In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execu… |
CVE-2024-49747 | Critical | 9.8 | 2025-01-21 | In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to remote code execu… |
CVE-2024-49745 | High | 7.8 | 2025-01-21 | In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no a… |
CVE-2024-49744 | High | 7.8 | 2025-01-21 | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization… |
CVE-2024-49742 | High | 7.8 | 2025-01-21 | In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due to a missing permi… |
CVE-2024-49738 | High | 7.8 | 2025-01-21 | In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privilege with no additional execution privilege… |
CVE-2024-49737 | High | 7.8 | 2025-01-21 | In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error… |
CVE-2024-49736 | Medium | 5.5 | 2025-01-21 | In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead… |
CVE-2024-49735 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege… |
CVE-2024-49734 | High | 7.5 | 2025-01-21 | In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to… |
CVE-2024-49733 | Medium | 5.5 | 2025-01-21 | In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could l… |
CVE-2024-49732 | High | 7.8 | 2025-01-21 | In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missing permission chec… |
CVE-2024-49724 | High | 7.0 | 2025-01-21 | In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a race condition. Thi… |
CVE-2024-43771 | High | 8.8 | 2025-01-21 | In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) c… |
CVE-2024-43770 | High | 8.8 | 2025-01-21 | In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent)… |
CVE-2024-43765 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This could lead to local escalation of privileg… |
CVE-2024-43763 | Medium | 6.5 | 2025-01-21 | In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This could lead to remote (proximal/adjacent) de… |
CVE-2024-43096 | High | 8.8 | 2025-01-21 | In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) cod… |
CVE-2024-43095 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2024-34730 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error in the code. This could lead to local esc… |
CVE-2024-24443 | Medium | 6.5 | 2025-01-21 | An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 al… |
CVE-2024-24428 | High | 7.5 | 2025-01-21 | A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet. |
CVE-2024-24427 | High | 7.5 | 2025-01-21 | A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
CVE-2024-24424 | High | 7.5 | 2025-01-21 | A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows atta… |
CVE-2024-24423 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_e… |
CVE-2024-24422 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a stack overflow in the decode_pr… |
CVE-2024-24421 | Critical | 9.8 | 2025-01-21 | A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execu… |
CVE-2024-24420 | High | 7.5 | 2025-01-21 | A reachable assertion in the decode_linked_ti_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to… |
CVE-2024-24419 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_t… |
CVE-2024-24418 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_p… |
CVE-2024-24417 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_p… |
CVE-2024-24416 | High | 7.5 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_a… |
CVE-2024-51941 | High | 8.8 | 2025-01-21 | A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code… |
CVE-2024-45479 | Critical | 9.1 | 2025-01-21 | SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, wh… |