2024 CVEs (page 43)
Page 43 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56277 | Medium | 5.3 | 2025-01-21 | Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5. |
CVE-2024-51919 | Critical | 9.0 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designe… |
CVE-2024-51888 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login… |
CVE-2024-51818 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.Thi… |
CVE-2024-49700 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.Th… |
CVE-2024-49699 | High | 8.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-49688 | Critical | 9.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-49666 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.Th… |
CVE-2024-49655 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.Th… |
CVE-2024-49333 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-49303 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-49300 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-32555 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate… |
CVE-2024-57946 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-bl… |
CVE-2024-57945 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue of vmemmap address In sparse vmemmap model, the vir… |
CVE-2024-57944 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_init devm_kasprintf() can return a NULL p… |
CVE-2024-57943 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix the new buffer was not zeroed before writing Before writing, if a buffer_head… |
CVE-2024-57942 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At the end of netfs_unlock_read_folio() in w… |
CVE-2024-57941 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled When the cac… |
CVE-2024-57940 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a… |
CVE-2024-57939 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler… |
CVE-2024-57938 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default… |
CVE-2024-57936 | Critical | 9.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQ… |
CVE-2024-57935 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to… |
CVE-2024-57934 | Medium | 4.7 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array[] In __ftrace_return_to_handler(), a… |
CVE-2024-57933 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling a… |
CVE-2024-57932 | Critical | 9.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exis… |
CVE-2024-57931 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore… |
CVE-2024-57930 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a T… |
CVE-2024-52973 | Medium | 6.5 | 2025-01-21 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This c… |
CVE-2024-43709 | Medium | 6.5 | 2025-01-21 | An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted… |
CVE-2024-37284 | Medium | 5.5 | 2025-01-21 | Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This… |
CVE-2024-13444 | Medium | 6.1 | 2025-01-21 | The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect no… |
CVE-2024-13230 | Medium | 5.3 | 2025-01-21 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializ… |
CVE-2024-11226 | Medium | 6.4 | 2025-01-21 | The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and includi… |
CVE-2024-6466 | Medium | 5.3 | 2025-01-21 | NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not… |
CVE-2024-13404 | Medium | 6.1 | 2025-01-21 | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2… |
CVE-2024-12104 | Medium | 5.3 | 2025-01-21 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capab… |
CVE-2024-12005 | Medium | 6.1 | 2025-01-21 | The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect… |
CVE-2024-10936 | High | 8.8 | 2025-01-21 | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted inpu… |
CVE-2024-13536 | Medium | 5.3 | 2025-01-21 | The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class… |
CVE-2024-45091 | Medium | 6.2 | 2025-01-21 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that coul… |
CVE-2024-13454 | Medium | 5.3 | 2025-01-20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenS… |
CVE-2024-22349 | Medium | 4.0 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2024-22348 | Medium | 5.3 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out… |
CVE-2024-22347 | Medium | 5.9 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-51738 | High | 8.1 | 2025-01-20 | Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and… |
CVE-2024-45647 | Medium | 5.6 | 2025-01-20 | IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the… |
CVE-2024-13176 | Medium | 4.1 | 2025-01-20 | Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A tim… |
CVE-2024-13524 | Medium | 4.5 | 2025-01-20 | A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-41783 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operati… |
CVE-2024-41743 | High | 7.5 | 2025-01-19 | IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of reso… |
CVE-2024-41742 | High | 7.5 | 2025-01-19 | IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By cond… |
CVE-2024-38337 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive informat… |
CVE-2024-57929 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read… |
CVE-2024-57928 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecache() gets an error f… |
CVE-2024-57927 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: nfs: Fix oops in nfs_netfs_init_request() when copying to cache When netfslib wants to co… |
CVE-2024-57926 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err Th… |
CVE-2024-57925 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_all… |
CVE-2024-57924 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually p… |
CVE-2024-57923 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data le… |
CVE-2024-57922 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functi… |
CVE-2024-57921 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When running YouTube videos… |
CVE-2024-57919 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix divide error in DM plane scale calcs dm_get_plane_scale doesn't take… |
CVE-2024-57918 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using… |
CVE-2024-57917 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the follow… |
CVE-2024-57916 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling Resolve kernel p… |
CVE-2024-57914 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix NULL pointer issue on shared irq case The tcpci_irq() may meet bel… |
CVE-2024-57913 | Medium | 4.7 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue relat… |
CVE-2024-57912 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: pressure: zpa2326: fix information leak in triggered buffer The 'sample' local struc… |
CVE-2024-57911 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data'… |
CVE-2024-57910 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array i… |
CVE-2024-57909 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is u… |
CVE-2024-57908 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is use… |
CVE-2024-57907 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local stru… |
CVE-2024-57906 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array i… |
CVE-2024-57905 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix information leak in triggered buffer The 'scan' local struct is… |
CVE-2024-57904 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of a… |
CVE-2024-8722 | Medium | 5.5 | 2025-01-19 | The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, a… |
CVE-2024-45654 | Medium | 4.3 | 2025-01-19 | IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs. |
CVE-2024-45653 | Medium | 4.3 | 2025-01-19 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could… |
CVE-2024-45652 | Medium | 6.5 | 2025-01-19 | IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2024-45662 | High | 7.5 | 2025-01-18 | IBM Safer Payments 6.4.0.00 through 6.4.2.07, 6.5.0.00 through 6.5.0.05, and 6.6.0.00 through 6.6.0.03 could allow a remote attacker to cause a denial of servi… |
CVE-2024-49824 | Medium | 6.5 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18… |
CVE-2024-49354 | Medium | 5.3 | 2025-01-18 | IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls. |
CVE-2024-47113 | High | 8.1 | 2025-01-18 | IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML stateme… |
CVE-2024-47106 | Medium | 5.3 | 2025-01-18 | IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that cou… |
CVE-2024-51448 | Medium | 6.7 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the inst… |
CVE-2024-49338 | Medium | 4.4 | 2025-01-18 | IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. |
CVE-2024-13375 | Critical | 9.8 | 2025-01-18 | The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to… |
CVE-2024-13184 | High | 7.5 | 2025-01-18 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions u… |
CVE-2024-13392 | Medium | 6.4 | 2025-01-18 | The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_… |
CVE-2024-13519 | Medium | 4.4 | 2025-01-18 | The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings… |
CVE-2024-13517 | Medium | 4.4 | 2025-01-18 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title val… |
CVE-2024-13433 | Medium | 6.4 | 2025-01-18 | The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and includi… |
CVE-2024-13432 | Medium | 6.1 | 2025-01-18 | The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incor… |
CVE-2024-13393 | Medium | 6.4 | 2025-01-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos… |
CVE-2024-13391 | Medium | 6.4 | 2025-01-18 | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2024-13385 | Medium | 6.4 | 2025-01-18 | The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to… |
CVE-2024-13317 | Medium | 4.3 | 2025-01-18 | The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is d… |