2024 CVEs (page 5)
Page 5 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58280 | High | 8.8 | 2025-12-10 | CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. A… |
CVE-2024-58279 | High | 8.8 | 2025-12-10 | appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the file… |
CVE-2024-2105 | Medium | 6.5 | 2025-12-10 | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices. |
CVE-2024-2104 | High | 8.8 | 2025-12-10 | Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands throug… |
CVE-2024-47570 | Medium | 6.6 | 2025-12-09 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7… |
CVE-2024-56840 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56839 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56838 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56837 | High | 7.2 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56836 | High | 7.5 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56835 | High | 8.8 | 2025-12-09 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2024-56464 | Low | 2.7 | 2025-12-09 | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed thi… |
CVE-2024-38798 | | 2025-12-09 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful expl… | |
CVE-2024-9183 | High | 7.7 | 2025-12-05 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have… |
CVE-2024-58278 | | 2025-12-04 | perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can co… | |
CVE-2024-58277 | | 2025-12-04 | R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authenticati… | |
CVE-2024-58276 | | 2025-12-04 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execut… | |
CVE-2024-58275 | | 2025-12-04 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter in… | |
CVE-2024-5401 | Medium | 4.3 | 2025-12-04 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-6… |
CVE-2024-45539 | High | 7.5 | 2025-12-04 | Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller… |
CVE-2024-45538 | Critical | 9.6 | 2025-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Uni… |
CVE-2024-3884 | High | 7.5 | 2025-12-03 | A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) m… |
CVE-2024-32643 | High | 7.5 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ dec… |
CVE-2024-32642 | High | 8.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows… |
CVE-2024-32641 | Critical | 9.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution… |
CVE-2024-45675 | High | 8.4 | 2025-12-02 | IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password. |
CVE-2024-53684 | High | 7.5 | 2025-12-01 | A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request… |
CVE-2024-49572 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-48894 | Medium | 5.9 | 2025-12-01 | A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to… |
CVE-2024-48882 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-45370 | High | 7.3 | 2025-12-01 | An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database… |
CVE-2024-39148 | High | 8.1 | 2025-12-01 | The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS… |
CVE-2024-32388 | Medium | 5.3 | 2025-12-01 | Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to by… |
CVE-2024-32384 | Medium | 6.8 | 2025-12-01 | Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer secu… |
CVE-2024-56089 | High | 7.5 | 2025-12-01 | An issue in Technitium through v13.2.2 enables attackers to conduct a DNS cache poisoning attack and inject fake responses by reviving the birthday attack. |
CVE-2024-5540 | | 2025-11-27 | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious… | |
CVE-2024-5539 | | 2025-11-27 | The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended a… | |
CVE-2024-47856 | Critical | 9.8 | 2025-11-24 | In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not… |
CVE-2024-14007 | | 2025-11-24 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authenticatio… | |
CVE-2024-14015 | High | 7.1 | 2025-11-24 | The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-21923 | High | 7.3 | 2025-11-23 | Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. |
CVE-2024-21922 | High | 7.3 | 2025-11-23 | A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2024-8528 | | 2025-11-19 | Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not bein… | |
CVE-2024-8527 | | 2025-11-19 | Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions. | |
CVE-2024-44664 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php. |
CVE-2024-44661 | Medium | 5.4 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to Cross Site Scripting (XSS) via the quantity parameter in my-cart.php. |
CVE-2024-44659 | Critical | 9.8 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. |
CVE-2024-46335 | Medium | 4.6 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. |
CVE-2024-44663 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php. |
CVE-2024-44662 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. |
CVE-2024-44660 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php. |
CVE-2024-44658 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php. |
CVE-2024-44655 | Medium | 6.1 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) via the search parameter in user-search.php. |
CVE-2024-44654 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php. |
CVE-2024-44657 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport.php. |
CVE-2024-44653 | Medium | 6.5 | 2025-11-17 | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php. |
CVE-2024-44651 | Medium | 6.5 | 2025-11-17 | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recover_email parameter in user_password_recover.php. |
CVE-2024-46336 | Medium | 6.1 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. |
CVE-2024-46334 | Medium | 6.1 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. |
CVE-2024-44652 | Medium | 6.5 | 2025-11-17 | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address parameters in user… |
CVE-2024-44648 | Medium | 6.5 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. |
CVE-2024-44647 | Medium | 6.1 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. |
CVE-2024-44644 | Medium | 6.5 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php. |
CVE-2024-44641 | Medium | 6.5 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php. |
CVE-2024-55016 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. |
CVE-2024-44640 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php. |
CVE-2024-44639 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. |
CVE-2024-44636 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. |
CVE-2024-44635 | Medium | 6.1 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php. |
CVE-2024-44633 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php. |
CVE-2024-44632 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. |
CVE-2024-44630 | Medium | 6.5 | 2025-11-14 | Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname… |
CVE-2024-42749 | Medium | 6.1 | 2025-11-14 | Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script. |
CVE-2024-21635 | High | 7.5 | 2025-11-14 | Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the e… |
CVE-2024-9126 | High | 7.5 | 2025-11-14 | Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2024-7021 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2024-7017 | High | 7.5 | 2025-11-14 | Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a craft… |
CVE-2024-13983 | Medium | 6.3 | 2025-11-14 | Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Ch… |
CVE-2024-13178 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (C… |
CVE-2024-11920 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a craf… |
CVE-2024-11919 | Medium | 4.3 | 2025-11-14 | Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML… |
CVE-2024-48829 | Medium | 6.7 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileg… |
CVE-2024-47866 | High | 7.5 | 2025-11-12 | Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object… |
CVE-2024-45301 | Medium | 5.3 | 2025-11-12 | Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a fil… |
CVE-2024-32014 | Medium | 4.7 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local databas… |
CVE-2024-32011 | High | 8.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands… |
CVE-2024-32010 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database… |
CVE-2024-32009 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escal… |
CVE-2024-32008 | High | 7.8 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escal… |
CVE-2024-57695 | High | 7.7 | 2025-11-11 | An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock functio… |
CVE-2024-47118 | Medium | 6.5 | 2025-11-07 | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Ser… |
CVE-2024-12125 | High | 7.5 | 2025-11-06 | A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly con… |
CVE-2024-25621 | High | 7.3 | 2025-11-06 | containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through… |
CVE-2024-56426 | High | 7.5 | 2025-11-04 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1… |
CVE-2024-13998 | Medium | 6.5 | 2025-11-03 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to a… |
CVE-2024-13997 | High | 7.2 | 2025-11-03 | Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server f… |
CVE-2024-51317 | Medium | 6.5 | 2025-11-03 | An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function |
CVE-2024-13992 | Medium | 5.4 | 2025-10-31 | Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link fr… |
CVE-2024-58273 | High | 7.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apa… |
CVE-2024-14009 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administr… |