2024 CVEs (page 48)
Page 48 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34166 | Critical | 10.0 | 2025-01-14 | An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-21797 | Critical | 9.1 | 2025-01-14 | A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le… |
CVE-2024-7344 | High | 8.2 | 2025-01-14 | Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. |
CVE-2024-56497 | Medium | 6.7 | 2025-01-14 | An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 thro… |
CVE-2024-55593 | Low | 2.7 | 2025-01-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to ga… |
CVE-2024-55591 | Critical | 9.8 | 2025-01-14 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0… |
CVE-2024-54021 | Medium | 6.5 | 2025-01-14 | An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, Forti… |
CVE-2024-52969 | Medium | 4.1 | 2025-01-14 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, version 7.1… |
CVE-2024-52967 | Low | 3.5 | 2025-01-14 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauth… |
CVE-2024-52963 | Low | 3.7 | 2025-01-14 | A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker… |
CVE-2024-50566 | High | 7.2 | 2025-01-14 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1… |
CVE-2024-50564 | Low | 3.3 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a… |
CVE-2024-48893 | Medium | 6.8 | 2025-01-14 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authen… |
CVE-2024-48890 | Medium | 6.6 | 2025-01-14 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7… |
CVE-2024-48886 | Critical | 9.0 | 2025-01-14 | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7… |
CVE-2024-48884 | High | 7.5 | 2025-01-14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1… |
CVE-2024-47572 | Critical | 9.0 | 2025-01-14 | An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands… |
CVE-2024-47571 | High | 8.1 | 2025-01-14 | An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate vi… |
CVE-2024-47566 | Medium | 5.1 | 2025-01-14 | A improper limitation of a pathname to a restricted directory ('path traversal') [CWE-23] in Fortinet FortiRecorder version 7.2.0 through 7.2.1 and before 7.0… |
CVE-2024-46670 | High | 7.5 | 2025-01-14 | An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 2… |
CVE-2024-46669 | Low | 3.5 | 2025-01-14 | An Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec I… |
CVE-2024-46668 | High | 7.5 | 2025-01-14 | An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions… |
CVE-2024-46667 | High | 7.5 | 2025-01-14 | A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0… |
CVE-2024-46666 | Medium | 5.3 | 2025-01-14 | An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0… |
CVE-2024-46665 | Low | 3.7 | 2025-01-14 | An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle… |
CVE-2024-46664 | Medium | 5.5 | 2025-01-14 | A relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to read files from the u… |
CVE-2024-45326 | Medium | 4.3 | 2025-01-14 | An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all version… |
CVE-2024-40587 | Medium | 6.7 | 2025-01-14 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 throu… |
CVE-2024-36512 | High | 7.2 | 2025-01-14 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4.3 and 7.2.0 through… |
CVE-2024-36510 | Medium | 5.3 | 2025-01-14 | An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7… |
CVE-2024-36506 | Low | 3.7 | 2025-01-14 | An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all v… |
CVE-2024-36504 | Medium | 6.5 | 2025-01-14 | An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6… |
CVE-2024-35278 | Medium | 4.3 | 2025-01-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7… |
CVE-2024-35277 | High | 8.6 | 2025-01-14 | A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7… |
CVE-2024-35276 | Medium | 5.6 | 2025-01-14 | A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.1… |
CVE-2024-35275 | Medium | 6.6 | 2025-01-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager vers… |
CVE-2024-35273 | High | 7.2 | 2025-01-14 | A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privileg… |
CVE-2024-33503 | Medium | 6.7 | 2025-01-14 | A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7… |
CVE-2024-33502 | Medium | 6.5 | 2025-01-14 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2… |
CVE-2024-32115 | Medium | 5.5 | 2025-01-14 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete… |
CVE-2024-27778 | High | 8.8 | 2025-01-14 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSa… |
CVE-2024-26012 | Medium | 6.7 | 2025-01-14 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, F… |
CVE-2024-23106 | High | 8.1 | 2025-01-14 | An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticate… |
CVE-2024-21758 | Medium | 6.4 | 2025-01-14 | A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code… |
CVE-2024-11864 | High | 7.5 | 2025-01-14 | Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP |
CVE-2024-11863 | Medium | 5.3 | 2025-01-14 | Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP |
CVE-2024-11497 | High | 8.8 | 2025-01-14 | An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access. |
CVE-2024-56841 | High | 7.4 | 2025-01-14 | A vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of the module are vulnerable to LDAP injection. This could allow… |
CVE-2024-53649 | Medium | 6.5 | 2025-01-14 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6M… |
CVE-2024-47100 | High | 7.1 | 2025-01-14 | A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMAT… |
CVE-2024-45385 | Medium | 4.7 | 2025-01-14 | A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). Affected components are vulnerable to reflected cross-site script… |
CVE-2024-12240 | Medium | 6.4 | 2025-01-14 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and includi… |
CVE-2024-12919 | Critical | 9.8 | 2025-01-14 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypas… |
CVE-2024-13156 | Medium | 6.4 | 2025-01-14 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parame… |
CVE-2024-11736 | Medium | 4.9 | 2025-01-14 | A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable UR… |
CVE-2024-11734 | Medium | 6.5 | 2025-01-14 | A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service… |
CVE-2024-12365 | High | 8.5 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in al… |
CVE-2024-12008 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug lo… |
CVE-2024-12006 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versio… |
CVE-2024-13323 | Medium | 6.4 | 2025-01-14 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and inclu… |
CVE-2024-12398 | High | 8.8 | 2025-01-14 | An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware… |
CVE-2024-57664 | High | 7.5 | 2025-01-14 | An issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57663 | High | 7.5 | 2025-01-14 | An issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57662 | High | 7.5 | 2025-01-14 | An issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57661 | High | 7.5 | 2025-01-14 | An issue in the sqlo_df component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57660 | High | 7.5 | 2025-01-14 | An issue in the sqlo_expand_jts component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57659 | High | 7.5 | 2025-01-14 | An issue in the sqlg_parallel_ts_seq component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2024-57658 | High | 7.5 | 2025-01-14 | An issue in the sql_tree_hash_1 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57657 | High | 7.5 | 2025-01-14 | An issue in the sqlg_vec_upd component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57656 | High | 7.5 | 2025-01-14 | An issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2024-57655 | High | 7.5 | 2025-01-14 | An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57654 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57653 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_set_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57652 | High | 7.5 | 2025-01-14 | An issue in the numeric_to_dv component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57651 | High | 7.5 | 2025-01-14 | An issue in the jp_add component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57650 | High | 7.5 | 2025-01-14 | An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2024-57649 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57648 | High | 7.5 | 2025-01-14 | An issue in the itc_set_param_row component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57647 | High | 7.5 | 2025-01-14 | An issue in the row_insert_cast component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57646 | High | 7.5 | 2025-01-14 | An issue in the psiginfo component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57645 | High | 7.5 | 2025-01-14 | An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2024-57644 | High | 7.5 | 2025-01-14 | An issue in the itc_hash_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57643 | High | 7.5 | 2025-01-14 | An issue in the box_deserialize_string component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2024-57642 | High | 7.5 | 2025-01-14 | An issue in the dfe_inx_op_col_def_table component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL… |
CVE-2024-57641 | High | 7.5 | 2025-01-14 | An issue in the sqlexp component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57640 | High | 7.5 | 2025-01-14 | An issue in the dc_add_int component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57639 | High | 7.5 | 2025-01-14 | An issue in the dc_elt_size component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57638 | High | 7.5 | 2025-01-14 | An issue in the dfe_body_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57637 | High | 7.5 | 2025-01-14 | An issue in the dfe_unit_gb_dependant component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL sta… |
CVE-2024-57636 | High | 7.5 | 2025-01-14 | An issue in the itc_sample_row_check component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2024-57635 | High | 7.5 | 2025-01-14 | An issue in the chash_array component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57634 | High | 7.5 | 2025-01-14 | An issue in the exp_copy component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57633 | High | 7.5 | 2025-01-14 | An issue in the exps_bind_column component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57632 | High | 7.5 | 2025-01-14 | An issue in the is_column_unique component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57631 | High | 7.5 | 2025-01-14 | An issue in the exp_ref component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57630 | High | 7.5 | 2025-01-14 | An issue in the exps_card component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57629 | High | 7.5 | 2025-01-14 | An issue in the tail_type component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57628 | High | 7.5 | 2025-01-14 | An issue in the exp_values_set_supertype component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57627 | High | 7.5 | 2025-01-14 | An issue in the gc_col component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57626 | High | 7.5 | 2025-01-14 | An issue in the mat_join2 component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |