2024 CVEs (page 44)
Page 44 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57913 | Medium | 4.7 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue relat… |
CVE-2024-57912 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: pressure: zpa2326: fix information leak in triggered buffer The 'sample' local struc… |
CVE-2024-57911 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data'… |
CVE-2024-57910 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array i… |
CVE-2024-57909 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is u… |
CVE-2024-57908 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is use… |
CVE-2024-57907 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local stru… |
CVE-2024-57906 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array i… |
CVE-2024-57905 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix information leak in triggered buffer The 'scan' local struct is… |
CVE-2024-57904 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of a… |
CVE-2024-8722 | Medium | 5.5 | 2025-01-19 | The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, a… |
CVE-2024-45654 | Medium | 4.3 | 2025-01-19 | IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs. |
CVE-2024-45653 | Medium | 4.3 | 2025-01-19 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could… |
CVE-2024-45652 | Medium | 6.5 | 2025-01-19 | IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2024-45662 | High | 7.5 | 2025-01-18 | IBM Safer Payments 6.4.0.00 through 6.4.2.07, 6.5.0.00 through 6.5.0.05, and 6.6.0.00 through 6.6.0.03 could allow a remote attacker to cause a denial of servi… |
CVE-2024-49824 | Medium | 6.5 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18… |
CVE-2024-49354 | Medium | 5.3 | 2025-01-18 | IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls. |
CVE-2024-47113 | High | 8.1 | 2025-01-18 | IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML stateme… |
CVE-2024-47106 | Medium | 5.3 | 2025-01-18 | IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that cou… |
CVE-2024-51448 | Medium | 6.7 | 2025-01-18 | IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the inst… |
CVE-2024-49338 | Medium | 4.4 | 2025-01-18 | IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. |
CVE-2024-13375 | Critical | 9.8 | 2025-01-18 | The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to… |
CVE-2024-13184 | High | 7.5 | 2025-01-18 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions u… |
CVE-2024-13392 | Medium | 6.4 | 2025-01-18 | The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_… |
CVE-2024-13519 | Medium | 4.4 | 2025-01-18 | The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings… |
CVE-2024-13517 | Medium | 4.4 | 2025-01-18 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title val… |
CVE-2024-13433 | Medium | 6.4 | 2025-01-18 | The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and includi… |
CVE-2024-13432 | Medium | 6.1 | 2025-01-18 | The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incor… |
CVE-2024-13393 | Medium | 6.4 | 2025-01-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos… |
CVE-2024-13391 | Medium | 6.4 | 2025-01-18 | The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2024-13385 | Medium | 6.4 | 2025-01-18 | The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to… |
CVE-2024-13317 | Medium | 4.3 | 2025-01-18 | The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is d… |
CVE-2024-12696 | Medium | 6.4 | 2025-01-18 | The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_p… |
CVE-2024-12385 | Medium | 6.1 | 2025-01-18 | The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce val… |
CVE-2024-9020 | Medium | 5.4 | 2025-01-18 | The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2024-13516 | Medium | 6.1 | 2025-01-18 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including… |
CVE-2024-13515 | Medium | 6.1 | 2025-01-18 | The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter i… |
CVE-2024-12071 | Medium | 5.3 | 2025-01-18 | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to… |
CVE-2024-11923 | Medium | 5.5 | 2025-01-18 | Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to… |
CVE-2024-57252 | Medium | 4.3 | 2025-01-17 | OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily. |
CVE-2024-57035 | Critical | 9.8 | 2025-01-17 | WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php. |
CVE-2024-57033 | Medium | 6.1 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php. |
CVE-2024-57372 | Medium | 6.1 | 2025-01-17 | Cross Site Scripting vulnerability in InformationPush master version allows a remote attacker to obtain sensitive information via the title, time and msg param… |
CVE-2024-57370 | Medium | 6.1 | 2025-01-17 | Cross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a remote attacker to obtain sensitive information via the w parameter. |
CVE-2024-57369 | Medium | 6.4 | 2025-01-17 | Clickjacking vulnerability in typecho v1.2.1. |
CVE-2024-57034 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter. |
CVE-2024-57032 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is poss… |
CVE-2024-57031 | Critical | 9.8 | 2025-01-17 | WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter. |
CVE-2024-57030 | High | 8.1 | 2025-01-17 | Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter. |
CVE-2024-52870 | High | 7.1 | 2025-01-17 | Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromiu… |
CVE-2024-13026 | | 2025-01-17 | A vulnerability exists in Algo Edge up to 2.1.1 - a previously used (legacy) component of navify® Algorithm Suite. The vulnerability impacts the authenticatio… | |
CVE-2024-12757 | High | 8.6 | 2025-01-17 | Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code. |
CVE-2024-54681 | Low | 3.5 | 2025-01-17 | Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to… |
CVE-2024-53683 | Medium | 4.4 | 2025-01-17 | A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to… |
CVE-2024-45832 | Medium | 4.3 | 2025-01-17 | Hard-coded credentials were included as part of the application binary. These credentials served as part of the application authentication flow and communica… |
CVE-2024-26157 | Medium | 6.1 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method unde… |
CVE-2024-26156 | Medium | 4.8 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter… |
CVE-2024-26155 | Medium | 6.8 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS w… |
CVE-2024-26154 | Medium | 4.8 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC… |
CVE-2024-26153 | High | 7.4 | 2025-01-17 | All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no acc… |
CVE-2024-50967 | Medium | 6.5 | 2025-01-17 | The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this e… |
CVE-2024-13503 | | 2025-01-17 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signa… | |
CVE-2024-13502 | | 2025-01-17 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux… | |
CVE-2024-12703 | High | 7.8 | 2025-01-17 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2024-12142 | High | 8.6 | 2025-01-17 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modifi… |
CVE-2024-10498 | Medium | 6.5 | 2025-01-17 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacker to modify confi… |
CVE-2024-10497 | High | 8.8 | 2025-01-17 | CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outside those defined b… |
CVE-2024-13378 | Medium | 5.4 | 2025-01-17 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including… |
CVE-2024-13377 | High | 7.2 | 2025-01-17 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due t… |
CVE-2024-12476 | High | 7.8 | 2025-01-17 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and… |
CVE-2024-12399 | High | 7.1 | 2025-01-17 | CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confide… |
CVE-2024-12370 | Medium | 5.3 | 2025-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all version… |
CVE-2024-11425 | High | 7.5 | 2025-01-17 | CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a… |
CVE-2024-11139 | | 2025-01-17 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exploit these issues… | |
CVE-2024-13386 | Medium | 6.4 | 2025-01-17 | The quote-posttype-plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Author field in all versions up to, and including, 1.2.2 du… |
CVE-2024-13367 | Medium | 6.5 | 2025-01-17 | The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, an… |
CVE-2024-13366 | Medium | 6.1 | 2025-01-17 | The Sandbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'debug' parameter in all versions up to, and including, 0.4 due to ins… |
CVE-2024-12637 | Medium | 5.3 | 2025-01-17 | The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality… |
CVE-2024-12598 | Medium | 6.4 | 2025-01-17 | The MyBookProgress by Stormhill Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘book’ parameter in all versions up to, and inc… |
CVE-2024-12508 | Medium | 6.4 | 2025-01-17 | The Glofox Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glofox' and 'glofox_lead_capture ' shortcodes in all… |
CVE-2024-12466 | Medium | 6.1 | 2025-01-17 | The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 d… |
CVE-2024-12203 | Medium | 4.4 | 2025-01-17 | The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_color’ parameter in all versions up to, and including, 5.2… |
CVE-2024-13333 | High | 7.5 | 2025-01-17 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' funct… |
CVE-2024-11146 | Medium | 6.3 | 2025-01-17 | TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal… |
CVE-2024-10799 | Medium | 6.5 | 2025-01-17 | The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() functi… |
CVE-2024-13434 | Medium | 6.1 | 2025-01-17 | The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including… |
CVE-2024-13401 | Medium | 6.4 | 2025-01-17 | The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_paypal_checkout' shortcode in all versions… |
CVE-2024-13398 | Medium | 6.4 | 2025-01-17 | The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up t… |
CVE-2024-51462 | Medium | 4.0 | 2025-01-17 | IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of a… |
CVE-2024-52363 | Medium | 6.5 | 2025-01-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL requ… |
CVE-2024-34579 | High | 7.8 | 2025-01-17 | Fuji Electric Alpha5 SMART is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2024-57785 | Medium | 4.9 | 2025-01-16 | Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php. |
CVE-2024-57784 | Medium | 5.5 | 2025-01-16 | An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. |
CVE-2024-57704 | High | 8.8 | 2025-01-16 | Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The… |
CVE-2024-57703 | Critical | 9.8 | 2025-01-16 | Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The… |
CVE-2024-56144 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2024-53553 | Critical | 9.1 | 2025-01-16 | An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. |
CVE-2024-40514 | Medium | 4.6 | 2025-01-16 | Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload f… |
CVE-2024-40513 | Medium | 4.6 | 2025-01-16 | An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function. |
CVE-2024-55511 | High | 7.8 | 2025-01-16 | A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their priv… |