2024 CVEs (page 45)
Page 45 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57772 | Medium | 4.8 | 2025-01-16 | A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary w… |
CVE-2024-57771 | Medium | 4.8 | 2025-01-16 | A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web sc… |
CVE-2024-57770 | High | 8.8 | 2025-01-16 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. |
CVE-2024-57769 | High | 8.8 | 2025-01-16 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. |
CVE-2024-57768 | Critical | 9.8 | 2025-01-16 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. |
CVE-2024-50633 | Unrated | | 2025-01-16 | A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the… |
CVE-2024-41746 | High | 7.2 | 2025-01-16 | IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2024-37181 | Low | 2.6 | 2025-01-16 | Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable… |
CVE-2024-57611 | Low | 3.5 | 2025-01-16 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId. |
CVE-2024-57162 | High | 7.2 | 2025-01-16 | Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php. |
CVE-2024-57161 | Medium | 4.3 | 2025-01-16 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/edit.html |
CVE-2024-57160 | Medium | 4.3 | 2025-01-16 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaTask/edit.html. |
CVE-2024-57159 | Low | 3.5 | 2025-01-16 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add.html. |
CVE-2024-50563 | High | 7.3 | 2025-01-16 | A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 throu… |
CVE-2024-13387 | Medium | 6.4 | 2025-01-16 | The WP Responsive Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprtabs' shortcode in all versions up to, and includ… |
CVE-2024-13355 | Medium | 5.4 | 2025-01-16 | The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file typ… |
CVE-2024-12615 | Medium | 6.5 | 2025-01-16 | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX actions in all versions up to, and includ… |
CVE-2024-12614 | High | 7.5 | 2025-01-16 | The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and '… |
CVE-2024-12613 | High | 7.5 | 2025-01-16 | The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versions up to, and inclu… |
CVE-2024-12427 | Medium | 5.3 | 2025-01-16 | The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action… |
CVE-2024-48885 | Medium | 5.3 | 2025-01-16 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0… |
CVE-2024-45331 | High | 7.3 | 2025-01-16 | A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions… |
CVE-2024-12226 | Medium | 6.5 | 2025-01-16 | In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was i… |
CVE-2024-11452 | Medium | 6.4 | 2025-01-16 | The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in… |
CVE-2024-10789 | Medium | 4.3 | 2025-01-16 | The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing… |
CVE-2024-10970 | Medium | 5.4 | 2025-01-16 | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-57728 | High | 7.2 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (… |
CVE-2024-57727 | High | 7.5 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to d… |
CVE-2024-57726 | Critical | 9.9 | 2025-01-15 | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions… |
CVE-2024-55503 | Low | 3.3 | 2025-01-15 | An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component. |
CVE-2024-53407 | Low | 3.3 | 2025-01-15 | In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorize… |
CVE-2024-41454 | Medium | 6.5 | 2025-01-15 | An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitra… |
CVE-2024-41453 | Medium | 4.8 | 2025-01-15 | A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2024-39967 | Medium | 6.5 | 2025-01-15 | Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command. |
CVE-2024-36751 | Medium | 6.5 | 2025-01-15 | An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. |
CVE-2024-48126 | Critical | 9.8 | 2025-01-15 | HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access. |
CVE-2024-48125 | High | 7.5 | 2025-01-15 | An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests. |
CVE-2024-48123 | High | 8.4 | 2025-01-15 | An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB de… |
CVE-2024-48122 | Medium | 6.7 | 2025-01-15 | Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges. |
CVE-2024-48121 | Medium | 6.5 | 2025-01-15 | The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain acc… |
CVE-2024-54540 | Medium | 4.3 | 2025-01-15 | The issue was addressed with improved input sanitization. This issue is fixed in Apple Music 1.5.0.152 for Windows. Processing maliciously crafted web content… |
CVE-2024-54535 | Medium | 4.3 | 2025-01-15 | A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An at… |
CVE-2024-54470 | Medium | 4.6 | 2025-01-15 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker with physical acce… |
CVE-2024-44136 | Medium | 4.6 | 2025-01-15 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to a device may b… |
CVE-2024-40854 | Medium | 5.5 | 2025-01-15 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS… |
CVE-2024-40839 | Low | 2.4 | 2025-01-15 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device… |
CVE-2024-40771 | High | 7.8 | 2025-01-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
CVE-2024-27856 | High | 7.8 | 2025-01-15 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tv… |
CVE-2024-52005 | High | 8.8 | 2025-01-15 | Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git… |
CVE-2024-7085 | | 2025-01-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows… | |
CVE-2024-57025 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg. |
CVE-2024-57024 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg. |
CVE-2024-57023 | Medium | 6.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg. |
CVE-2024-57022 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg. |
CVE-2024-57021 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg. |
CVE-2024-57020 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg. |
CVE-2024-57019 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg. |
CVE-2024-57018 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg. |
CVE-2024-57017 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg. |
CVE-2024-57016 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg. |
CVE-2024-57015 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg. |
CVE-2024-57014 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg. |
CVE-2024-57013 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg. |
CVE-2024-57012 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg. |
CVE-2024-57011 | High | 8.8 | 2025-01-15 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg. |
CVE-2024-52783 | Medium | 5.1 | 2025-01-15 | Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via modification of th… |
CVE-2024-50954 | High | 7.5 | 2025-01-15 | The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is est… |
CVE-2024-50953 | High | 7.5 | 2025-01-15 | An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. |
CVE-2024-8603 | High | 7.5 | 2025-01-15 | A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp Vie… |
CVE-2024-56295 | Medium | 6.5 | 2025-01-15 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-47140 | High | 8.7 | 2025-01-15 | A cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitr… |
CVE-2024-47002 | High | 8.7 | 2025-01-15 | A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can lead to an arbitrary ht… |
CVE-2024-45061 | High | 8.7 | 2025-01-15 | A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead… |
CVE-2024-12084 | Critical | 9.8 | 2025-01-15 | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in t… |
CVE-2024-11322 | High | 7.5 | 2025-01-15 | A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process v… |
CVE-2024-5198 | Low | 3.3 | 2025-01-15 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NU… |
CVE-2024-57903 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could acci… |
CVE-2024-57902 | High | 7.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a… |
CVE-2024-57901 | High | 7.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case… |
CVE-2024-57900 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping()… |
CVE-2024-57899 | High | 7.6 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems On 32-bit systems, th… |
CVE-2024-57898 | Low | 3.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, du… |
CVE-2024-57897 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Correct the migration DMA map direction The SVM DMA device map direction shou… |
CVE-2024-57896 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During… |
CVE-2024-57895 | High | 7.1 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: set ATTR_CTIME flags when setting mtime David reported that the new warning from s… |
CVE-2024-57893 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx me… |
CVE-2024-57892 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and t… |
CVE-2024-57891 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix invalid irq restore in scx_ops_bypass() While adding outer irqsave/restore… |
CVE-2024-57890 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_coun… |
CVE-2024-57889 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses… |
CVE-2024-57888 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker Af… |
CVE-2024-57887 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() The host_node pointer was assign… |
CVE-2024-57886 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix new damon_target objects leaks on damon_commit_targets() Patch series… |
CVE-2024-57885 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: fix sleeping function called from invalid context at print message Address a… |
CVE-2024-57884 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() … |
CVE-2024-57883 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased… |
CVE-2024-57882 | Critical | 9.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix TCP options overflow. Syzbot reported the following splat: Oops: general prot… |
CVE-2024-57857 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Remove direct link to net_device Do not manage a per device direct link to net_… |
CVE-2024-57844 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix fault on fd close after unbind If userspace holds an fd open, unbinds the dev… |
CVE-2024-57841 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return fals… |