2024 CVEs (page 46)
Page 46 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8603 | High | 7.5 | 2025-01-15 | A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp Vie… |
CVE-2024-56295 | Medium | 6.5 | 2025-01-15 | Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-47140 | High | 8.7 | 2025-01-15 | A cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitr… |
CVE-2024-47002 | High | 8.7 | 2025-01-15 | A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can lead to an arbitrary ht… |
CVE-2024-45061 | High | 8.7 | 2025-01-15 | A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead… |
CVE-2024-12084 | Critical | 9.8 | 2025-01-15 | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in t… |
CVE-2024-11322 | High | 7.5 | 2025-01-15 | A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process v… |
CVE-2024-5198 | Low | 3.3 | 2025-01-15 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NU… |
CVE-2024-57903 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could acci… |
CVE-2024-57902 | High | 7.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a… |
CVE-2024-57901 | High | 7.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case… |
CVE-2024-57900 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping()… |
CVE-2024-57899 | High | 7.6 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems On 32-bit systems, th… |
CVE-2024-57898 | Low | 3.3 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, du… |
CVE-2024-57897 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Correct the migration DMA map direction The SVM DMA device map direction shou… |
CVE-2024-57896 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During… |
CVE-2024-57895 | High | 7.1 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: set ATTR_CTIME flags when setting mtime David reported that the new warning from s… |
CVE-2024-57893 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx me… |
CVE-2024-57892 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and t… |
CVE-2024-57891 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix invalid irq restore in scx_ops_bypass() While adding outer irqsave/restore… |
CVE-2024-57890 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_coun… |
CVE-2024-57889 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses… |
CVE-2024-57888 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker Af… |
CVE-2024-57887 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() The host_node pointer was assign… |
CVE-2024-57886 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix new damon_target objects leaks on damon_commit_targets() Patch series… |
CVE-2024-57885 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: fix sleeping function called from invalid context at print message Address a… |
CVE-2024-57884 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() … |
CVE-2024-57883 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased… |
CVE-2024-57882 | Critical | 9.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix TCP options overflow. Syzbot reported the following splat: Oops: general prot… |
CVE-2024-57857 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Remove direct link to net_device Do not manage a per device direct link to net_… |
CVE-2024-57844 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix fault on fd close after unbind If userspace holds an fd open, unbinds the dev… |
CVE-2024-57841 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return fals… |
CVE-2024-57802 | Critical | 9.4 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read fr… |
CVE-2024-57801 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload… |
CVE-2024-57795 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: h… |
CVE-2024-54031 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext Access to genmask fi… |
CVE-2024-53681 | Medium | 5.5 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats the subsysnqn strin… |
CVE-2024-39282 | High | 7.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix FSM command timeout issue When driver processes the internal state c… |
CVE-2024-36476 | Critical | 9.8 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' v… |
CVE-2024-13215 | Medium | 4.3 | 2025-01-15 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render… |
CVE-2024-11029 | Medium | 5.5 | 2025-01-15 | A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation proce… |
CVE-2024-12593 | Medium | 6.4 | 2025-01-15 | The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode… |
CVE-2024-11851 | Medium | 4.3 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification… |
CVE-2024-11848 | High | 8.1 | 2025-01-15 | The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_foreve… |
CVE-2024-35280 | Medium | 5.4 | 2025-01-15 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, Fort… |
CVE-2024-9636 | Critical | 9.8 | 2025-01-15 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not proper… |
CVE-2024-13351 | High | 7.2 | 2025-01-15 | The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortc… |
CVE-2024-12818 | Medium | 6.4 | 2025-01-15 | The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and inclu… |
CVE-2024-12423 | Medium | 6.1 | 2025-01-15 | The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up t… |
CVE-2024-12403 | Medium | 6.1 | 2025-01-15 | The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versio… |
CVE-2024-12297 | | 2025-01-15 | Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server… | |
CVE-2024-10775 | Medium | 4.3 | 2025-01-15 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template… |
CVE-2024-7322 | Medium | 5.8 | 2025-01-15 | A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes D… |
CVE-2024-4227 | High | 7.5 | 2025-01-15 | In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forcing to parse an XML having duplicate ID… |
CVE-2024-11870 | Medium | 6.4 | 2025-01-15 | The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, a… |
CVE-2024-55577 | High | 7.0 | 2025-01-15 | Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. When the software processes a file which is specially crafted by an attacker… |
CVE-2024-13394 | Medium | 6.4 | 2025-01-15 | The ViewMedica 9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewmedica' shortcode in all versions up to, and including… |
CVE-2024-13334 | Medium | 6.1 | 2025-01-15 | The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1… |
CVE-2024-57767 | High | 8.6 | 2025-01-15 | MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download. |
CVE-2024-57766 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField. |
CVE-2024-57765 | High | 7.5 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list. |
CVE-2024-57764 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add. |
CVE-2024-57763 | Critical | 9.1 | 2025-01-15 | MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField. |
CVE-2024-57762 | High | 7.5 | 2025-01-15 | MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file. |
CVE-2024-57761 | High | 8.1 | 2025-01-15 | An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-57760 | Medium | 6.5 | 2025-01-15 | JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java. |
CVE-2024-57757 | High | 7.5 | 2025-01-15 | JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. |
CVE-2024-57483 | Critical | 9.8 | 2025-01-14 | Tenda i24 V2.0.0.5 is vulnerable to Buffer Overflow in the addWifiMacFilter function. |
CVE-2024-57473 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address editing function. Attackers who successfull… |
CVE-2024-54730 | High | 7.5 | 2025-01-14 | Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. |
CVE-2024-54142 | Critical | 9.0 | 2025-01-14 | Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML… |
CVE-2024-53277 | Medium | 5.4 | 2025-01-14 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional featu… |
CVE-2024-47605 | Medium | 5.4 | 2025-01-14 | silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an… |
CVE-2024-42911 | High | 7.4 | 2025-01-14 | ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability. |
CVE-2024-57482 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function. Attackers who… |
CVE-2024-57480 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the AP configuration function. Attackers who successfully e… |
CVE-2024-57479 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address update function. Attackers who successfully… |
CVE-2024-57471 | Critical | 9.8 | 2025-01-14 | H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers wh… |
CVE-2024-50861 | Medium | 6.1 | 2025-01-14 | The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is s… |
CVE-2024-50859 | Medium | 4.8 | 2025-01-14 | The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected… |
CVE-2024-50858 | High | 8.8 | 2025-01-14 | Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a… |
CVE-2024-50857 | Medium | 4.8 | 2025-01-14 | The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability r… |
CVE-2024-48760 | Critical | 9.8 | 2025-01-14 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi fi… |
CVE-2024-45102 | Medium | 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instanc… |
CVE-2024-10254 | Medium | 4.7 | 2025-01-14 | A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system… |
CVE-2024-10253 | Medium | 4.7 | 2025-01-14 | A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash. |
CVE-2024-55945 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55924 | High | 8.0 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55923 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55922 | Medium | 5.4 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55921 | High | 7.5 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55920 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55894 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55893 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55892 | Medium | 4.8 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a qu… |
CVE-2024-55891 | Low | 3.1 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the pa… |
CVE-2024-53263 | | 2025-01-14 | Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to th… | |
CVE-2024-48858 | High | 7.5 | 2025-01-14 | Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service cond… |
CVE-2024-56374 | Medium | 5.8 | 2025-01-14 | An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when perf… |
CVE-2024-52006 | High | 7.5 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |