2024 CVEs (page 48)
Page 48 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35278 | Medium | 4.3 | 2025-01-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7… |
CVE-2024-35277 | High | 8.6 | 2025-01-14 | A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7… |
CVE-2024-35276 | Medium | 5.6 | 2025-01-14 | A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.1… |
CVE-2024-35275 | Medium | 6.6 | 2025-01-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager vers… |
CVE-2024-35273 | High | 7.2 | 2025-01-14 | A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privileg… |
CVE-2024-33503 | Medium | 6.7 | 2025-01-14 | A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7… |
CVE-2024-33502 | Medium | 6.5 | 2025-01-14 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2… |
CVE-2024-32115 | Medium | 5.5 | 2025-01-14 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete… |
CVE-2024-27778 | High | 8.8 | 2025-01-14 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSa… |
CVE-2024-26012 | Medium | 6.7 | 2025-01-14 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, F… |
CVE-2024-23106 | High | 8.1 | 2025-01-14 | An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticate… |
CVE-2024-21758 | Medium | 6.4 | 2025-01-14 | A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code… |
CVE-2024-11864 | High | 7.5 | 2025-01-14 | Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP |
CVE-2024-11863 | Medium | 5.3 | 2025-01-14 | Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP |
CVE-2024-11497 | High | 8.8 | 2025-01-14 | An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access. |
CVE-2024-56841 | High | 7.4 | 2025-01-14 | A vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of the module are vulnerable to LDAP injection. This could allow… |
CVE-2024-53649 | Medium | 6.5 | 2025-01-14 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6M… |
CVE-2024-47100 | High | 7.1 | 2025-01-14 | A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMAT… |
CVE-2024-45385 | Medium | 4.7 | 2025-01-14 | A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). Affected components are vulnerable to reflected cross-site script… |
CVE-2024-12240 | Medium | 6.4 | 2025-01-14 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and includi… |
CVE-2024-12919 | Critical | 9.8 | 2025-01-14 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypas… |
CVE-2024-13156 | Medium | 6.4 | 2025-01-14 | The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parame… |
CVE-2024-11736 | Medium | 4.9 | 2025-01-14 | A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable UR… |
CVE-2024-11734 | Medium | 6.5 | 2025-01-14 | A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service… |
CVE-2024-12365 | High | 8.5 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in al… |
CVE-2024-12008 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug lo… |
CVE-2024-12006 | Medium | 5.3 | 2025-01-14 | The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versio… |
CVE-2024-13323 | Medium | 6.4 | 2025-01-14 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and inclu… |
CVE-2024-12398 | High | 8.8 | 2025-01-14 | An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware… |
CVE-2024-57664 | High | 7.5 | 2025-01-14 | An issue in the sqlg_group_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57663 | High | 7.5 | 2025-01-14 | An issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57662 | High | 7.5 | 2025-01-14 | An issue in the sqlg_hash_source component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57661 | High | 7.5 | 2025-01-14 | An issue in the sqlo_df component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57660 | High | 7.5 | 2025-01-14 | An issue in the sqlo_expand_jts component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57659 | High | 7.5 | 2025-01-14 | An issue in the sqlg_parallel_ts_seq component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2024-57658 | High | 7.5 | 2025-01-14 | An issue in the sql_tree_hash_1 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57657 | High | 7.5 | 2025-01-14 | An issue in the sqlg_vec_upd component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57656 | High | 7.5 | 2025-01-14 | An issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2024-57655 | High | 7.5 | 2025-01-14 | An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57654 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57653 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_set_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57652 | High | 7.5 | 2025-01-14 | An issue in the numeric_to_dv component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57651 | High | 7.5 | 2025-01-14 | An issue in the jp_add component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57650 | High | 7.5 | 2025-01-14 | An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2024-57649 | High | 7.5 | 2025-01-14 | An issue in the qst_vec_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57648 | High | 7.5 | 2025-01-14 | An issue in the itc_set_param_row component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57647 | High | 7.5 | 2025-01-14 | An issue in the row_insert_cast component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statement… |
CVE-2024-57646 | High | 7.5 | 2025-01-14 | An issue in the psiginfo component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57645 | High | 7.5 | 2025-01-14 | An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2024-57644 | High | 7.5 | 2025-01-14 | An issue in the itc_hash_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2024-57643 | High | 7.5 | 2025-01-14 | An issue in the box_deserialize_string component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2024-57642 | High | 7.5 | 2025-01-14 | An issue in the dfe_inx_op_col_def_table component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL… |
CVE-2024-57641 | High | 7.5 | 2025-01-14 | An issue in the sqlexp component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57640 | High | 7.5 | 2025-01-14 | An issue in the dc_add_int component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57639 | High | 7.5 | 2025-01-14 | An issue in the dc_elt_size component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57638 | High | 7.5 | 2025-01-14 | An issue in the dfe_body_copy component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57637 | High | 7.5 | 2025-01-14 | An issue in the dfe_unit_gb_dependant component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL sta… |
CVE-2024-57636 | High | 7.5 | 2025-01-14 | An issue in the itc_sample_row_check component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stat… |
CVE-2024-57635 | High | 7.5 | 2025-01-14 | An issue in the chash_array component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57634 | High | 7.5 | 2025-01-14 | An issue in the exp_copy component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57633 | High | 7.5 | 2025-01-14 | An issue in the exps_bind_column component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57632 | High | 7.5 | 2025-01-14 | An issue in the is_column_unique component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57631 | High | 7.5 | 2025-01-14 | An issue in the exp_ref component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57630 | High | 7.5 | 2025-01-14 | An issue in the exps_card component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57629 | High | 7.5 | 2025-01-14 | An issue in the tail_type component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57628 | High | 7.5 | 2025-01-14 | An issue in the exp_values_set_supertype component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57627 | High | 7.5 | 2025-01-14 | An issue in the gc_col component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57626 | High | 7.5 | 2025-01-14 | An issue in the mat_join2 component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57625 | High | 7.5 | 2025-01-14 | An issue in the merge_table_prune_and_unionize component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2024-57624 | High | 7.5 | 2025-01-14 | An issue in the exp_atom component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57623 | High | 7.5 | 2025-01-14 | An issue in the HEAP_malloc component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57622 | High | 7.5 | 2025-01-14 | An issue in the exp_bin component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57621 | High | 7.5 | 2025-01-14 | An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57620 | High | 7.5 | 2025-01-14 | An issue in the trimchars component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57619 | High | 7.5 | 2025-01-14 | An issue in the atom_get_int component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57618 | High | 7.5 | 2025-01-14 | An issue in the bind_col_exp component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57617 | High | 7.5 | 2025-01-14 | An issue in the dameraulevenshtein component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57616 | High | 7.5 | 2025-01-14 | An issue in the vscanf component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-57615 | High | 7.5 | 2025-01-14 | An issue in the BATcalcbetween_intern component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-12298 | Medium | 5.5 | 2025-01-14 | We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerab… |
CVE-2024-12083 | Medium | 6.6 | 2025-01-14 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized… |
CVE-2024-11396 | Medium | 5.3 | 2025-01-14 | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inc… |
CVE-2024-57811 | Critical | 9.1 | 2025-01-13 | In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the… |
CVE-2024-56323 | Critical | 9.8 | 2025-01-13 | OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnera… |
CVE-2024-56138 | Medium | 4.0 | 2025-01-13 | notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Q… |
CVE-2024-51491 | Low | 3.3 | 2025-01-13 | notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Qu… |
CVE-2024-11128 | High | 7.8 | 2025-01-13 | A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) with… |
CVE-2024-46481 | High | 7.2 | 2025-01-13 | The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS. |
CVE-2024-46480 | High | 8.4 | 2025-01-13 | An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the under… |
CVE-2024-46921 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W1000, Modem 5… |
CVE-2024-46310 | Critical | 9.1 | 2025-01-13 | Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint |
CVE-2024-44771 | Medium | 6.1 | 2025-01-13 | BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function. |
CVE-2024-5743 | Critical | 9.8 | 2025-01-13 | An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code. This… |
CVE-2024-46920 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280. Lack of a length check leads to a stack out-of-boun… |
CVE-2024-46479 | Critical | 9.9 | 2025-01-13 | Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, le… |
CVE-2024-6352 | Medium | 4.3 | 2025-01-13 | A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert |
CVE-2024-57488 | Medium | 6.5 | 2025-01-13 | Code-Projects Online Car Rental System 1.0 is vulnerable to Cross Site Scripting (XSS) via the vehicalorcview parameter in /admin/edit-vehicle.php. |
CVE-2024-57487 | Medium | 6.5 | 2025-01-13 | In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP she… |
CVE-2024-54999 | Medium | 6.5 | 2025-01-13 | MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module. |
CVE-2024-48883 | Medium | 4.3 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |