2024 CVEs (page 46)
Page 46 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57802 | Critical | 9.4 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read fr… |
CVE-2024-57801 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload… |
CVE-2024-57795 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: h… |
CVE-2024-54031 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext Access to genmask fi… |
CVE-2024-53681 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats the subsysnqn strin… |
CVE-2024-39282 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix FSM command timeout issue When driver processes the internal state c… |
CVE-2024-36476 | Critical | 9.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' v… |
CVE-2024-13215 | Medium | 4.3 | 2025-01-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render… |
CVE-2024-11029 | Medium | 5.5 | 2025-01-15 | A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation proce… |
CVE-2024-12593 | Medium | 6.4 | 2025-01-15 | The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode… |
CVE-2024-11851 | Medium | 4.3 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification… |
CVE-2024-11848 | High | 8.1 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_foreve… |
CVE-2024-35280 | Medium | 5.4 | 2025-01-15 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, Fort… |
CVE-2024-9636 | Critical | 9.8 | 2025-01-15 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not proper… |
CVE-2024-13351 | High | 7.2 | 2025-01-15 | The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortc… |
CVE-2024-12818 | Medium | 6.4 | 2025-01-15 | The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and inclu… |
CVE-2024-12423 | Medium | 6.1 | 2025-01-15 | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up t… |
CVE-2024-12403 | Medium | 6.1 | 2025-01-15 | The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versio… |
CVE-2024-12297 | | 2025-01-15 | Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server… | |
CVE-2024-10775 | Medium | 4.3 | 2025-01-15 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template… |
CVE-2024-7322 | Medium | 5.8 | 2025-01-15 | A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes D… |
CVE-2024-4227 | High | 7.5 | 2025-01-15 | In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID… |
CVE-2024-11870 | Medium | 6.4 | 2025-01-15 | The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, a… |
CVE-2024-55577 | High | 7.0 | 2025-01-15 | Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. When the software processes a file which is specially crafted by an attacker… |
CVE-2024-13394 | Medium | 6.4 | 2025-01-15 | The ViewMedica 9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewmedica' shortcode in all versions up to, and including… |
CVE-2024-13334 | Medium | 6.1 | 2025-01-15 | The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1… |
CVE-2024-57767 | High | 8.6 | 2025-01-15 | MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download. |
CVE-2024-57766 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField. |
CVE-2024-57765 | High | 7.5 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list. |
CVE-2024-57764 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add. |
CVE-2024-57763 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField. |
CVE-2024-57762 | High | 7.5 | 2025-01-15 | MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file. |
CVE-2024-57761 | High | 8.1 | 2025-01-15 | An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-57760 | Medium | 6.5 | 2025-01-15 | JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java. |
CVE-2024-57757 | High | 7.5 | 2025-01-15 | JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. |
CVE-2024-57483 | Critical | 9.8 | 2025-01-14 | Tenda i24 V2.0.0.5 is vulnerable to Buffer Overflow in the addWifiMacFilter function. |
CVE-2024-57473 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address editing function. Attackers who successfull… |
CVE-2024-54730 | High | 7.5 | 2025-01-14 | Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. |
CVE-2024-54142 | Critical | 9.0 | 2025-01-14 | Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML… |
CVE-2024-53277 | Medium | 5.4 | 2025-01-14 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional featu… |
CVE-2024-47605 | Medium | 5.4 | 2025-01-14 | silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an… |
CVE-2024-42911 | High | 7.4 | 2025-01-14 | ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability. |
CVE-2024-57482 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function. Attackers who… |
CVE-2024-57480 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the AP configuration function. Attackers who successfully e… |
CVE-2024-57479 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address update function. Attackers who successfully… |
CVE-2024-57471 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers wh… |
CVE-2024-50861 | Medium | 6.1 | 2025-01-14 | The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is s… |
CVE-2024-50859 | Medium | 4.8 | 2025-01-14 | The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected… |
CVE-2024-50858 | High | 8.8 | 2025-01-14 | Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a… |
CVE-2024-50857 | Medium | 4.8 | 2025-01-14 | The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability r… |
CVE-2024-48760 | Critical | 9.8 | 2025-01-14 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi fi… |
CVE-2024-45102 | Medium | 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instanc… |
CVE-2024-10254 | Medium | 4.7 | 2025-01-14 | A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system… |
CVE-2024-10253 | Medium | 4.7 | 2025-01-14 | A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash. |
CVE-2024-55945 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55924 | High | 8.0 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55923 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55922 | Medium | 5.4 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55921 | High | 7.5 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55920 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55894 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55893 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55892 | Medium | 4.8 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a qu… |
CVE-2024-55891 | Low | 3.1 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the pa… |
CVE-2024-53263 | | 2025-01-14 | Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to th… | |
CVE-2024-48858 | High | 7.5 | 2025-01-14 | Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service cond… |
CVE-2024-56374 | Medium | 5.8 | 2025-01-14 | An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when perf… |
CVE-2024-52006 | High | 7.5 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2024-50349 | Medium | 4.7 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2024-50338 | High | 7.4 | 2025-01-14 | Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based… |
CVE-2024-49375 | Critical | 9.0 | 2025-01-14 | Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted… |
CVE-2024-48857 | High | 7.5 | 2025-01-14 | NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condi… |
CVE-2024-48856 | Critical | 9.8 | 2025-01-14 | Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition… |
CVE-2024-48855 | Medium | 5.3 | 2025-01-14 | Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in t… |
CVE-2024-48854 | Medium | 5.3 | 2025-01-14 | Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the… |
CVE-2024-13172 | High | 7.8 | 2025-01-14 | Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenti… |
CVE-2024-13171 | High | 7.8 | 2025-01-14 | Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthent… |
CVE-2024-13170 | High | 7.5 | 2025-01-14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated att… |
CVE-2024-13169 | High | 7.8 | 2025-01-14 | An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacke… |
CVE-2024-13168 | High | 7.5 | 2025-01-14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated att… |
CVE-2024-13167 | High | 7.5 | 2025-01-14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated att… |
CVE-2024-13166 | High | 7.5 | 2025-01-14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated att… |
CVE-2024-13165 | High | 7.5 | 2025-01-14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated att… |
CVE-2024-13164 | High | 7.8 | 2025-01-14 | An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated att… |
CVE-2024-13163 | High | 7.8 | 2025-01-14 | Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthen… |
CVE-2024-13162 | High | 7.2 | 2025-01-14 | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with… |
CVE-2024-13161 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-13160 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-13159 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-13158 | High | 7.2 | 2025-01-14 | An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenti… |
CVE-2024-12747 | Medium | 5.6 | 2025-01-14 | A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encounterin… |
CVE-2024-12088 | Medium | 6.5 | 2025-01-14 | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server… |
CVE-2024-12087 | Medium | 6.5 | 2025-01-14 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client option… |
CVE-2024-12086 | Medium | 6.1 | 2025-01-14 | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are b… |
CVE-2024-12085 | High | 7.5 | 2025-01-14 | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length… |
CVE-2024-53563 | Medium | 5.4 | 2025-01-14 | A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-53561 | High | 8.7 | 2025-01-14 | A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request. |
CVE-2024-52898 | Medium | 6.2 | 2025-01-14 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is ret… |
CVE-2024-45627 | Medium | 5.9 | 2025-01-14 | In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manage… |
CVE-2024-13181 | High | 7.3 | 2025-01-14 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes… |