2024 CVEs (page 50)
Page 50 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52319 | High | 7.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() cal… |
CVE-2024-51729 | High | 7.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() call… |
CVE-2024-50051 | High | 7.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which wil… |
CVE-2024-49573 | High | 7.0 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXT_BUDDY Adam reports that enabling NEXT_BUDDY insta triggers a WARN in… |
CVE-2024-49571 | Critical | 9.1 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When recei… |
CVE-2024-49569 | High | 7.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while… |
CVE-2024-49568 | Critical | 9.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receivi… |
CVE-2024-48881 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b ("bcache: R… |
CVE-2024-48876 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_sa… |
CVE-2024-48875 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011… |
CVE-2024-48873 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR The return value of i… |
CVE-2024-47809 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer… |
CVE-2024-47794 | High | 7.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tailcall infinite loop caused by freplace There is a potential infinite loop… |
CVE-2024-47408 | Critical | 9.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg… |
CVE-2024-47143 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held while hol… |
CVE-2024-47141 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc->pinmux data When two client of the same gpi… |
CVE-2024-46896 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't access invalid sched Since 2320c9e6a768 ("drm/sched: memset() 'job' in… |
CVE-2024-45828 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus cleanup path in DMA… |
CVE-2024-43098 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A… |
CVE-2024-41935 | High | 7.1 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to shrink read extent node in batches We use rwlock to protect core structure d… |
CVE-2024-41932 | Medium | 5.5 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added some logic to sched_se… |
CVE-2024-41149 | High | 7.8 | 2025-01-11 | In the Linux kernel, the following vulnerability has been resolved: block: avoid to reuse `hctx` not removed from cpuhp callback list If the 'hctx' isn't rem… |
CVE-2024-42175 | Low | 2.6 | 2025-01-11 | HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can le… |
CVE-2024-12877 | Critical | 9.8 | 2025-01-11 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 v… |
CVE-2024-12527 | Medium | 6.4 | 2025-01-11 | The Perfect Portal Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'perfect_portal_intake_form' shortcode in all ver… |
CVE-2024-12520 | Medium | 6.4 | 2025-01-11 | The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominion_shortcodes_domain_searc… |
CVE-2024-12519 | Medium | 6.4 | 2025-01-11 | The TCBD Auto Refresher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd_auto_refresh' shortcode in all versions up to… |
CVE-2024-12412 | Medium | 6.1 | 2025-01-11 | The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to St… |
CVE-2024-12407 | Medium | 6.1 | 2025-01-11 | The Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pushnotificationid' parameter in al… |
CVE-2024-12116 | Medium | 4.3 | 2025-01-11 | The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2… |
CVE-2024-11915 | Medium | 4.3 | 2025-01-11 | The RRAddons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.0 via the Popup block due to in… |
CVE-2024-11892 | Medium | 6.4 | 2025-01-11 | The Accordion Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordion_slider' shortcode in all versions up to… |
CVE-2024-11874 | Medium | 6.4 | 2025-01-11 | The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'grid_accordion' shortcode in all versions up to, an… |
CVE-2024-11758 | Medium | 6.4 | 2025-01-11 | The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due t… |
CVE-2024-11386 | Medium | 6.4 | 2025-01-11 | The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up t… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-42173 | Medium | 4.8 | 2025-01-11 | HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-12587 | Medium | 6.1 | 2025-01-11 | The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12304 | Medium | 6.4 | 2025-01-11 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in a… |
CVE-2024-42169 | High | 7.1 | 2025-01-11 | HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be… |
CVE-2024-42168 | High | 8.9 | 2025-01-11 | HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then ind… |
CVE-2024-12627 | High | 7.5 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all ve… |
CVE-2024-12505 | Medium | 6.4 | 2025-01-11 | The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0… |
CVE-2024-12472 | Medium | 4.3 | 2025-01-11 | The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() functi… |
CVE-2024-12404 | High | 7.5 | 2025-01-11 | The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 d… |
CVE-2024-12204 | Medium | 5.4 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to mis… |
CVE-2024-11327 | Medium | 6.1 | 2025-01-11 | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scr… |
CVE-2024-9188 | High | 8.8 | 2025-01-10 | Specially constructed queries cause cross platform scripting leaking administrator tokens |
CVE-2024-9134 | High | 8.3 | 2025-01-10 | Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-9132 | High | 8.1 | 2025-01-10 | The administrator is able to configure an insecure captive portal script |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2024-7142 | Medium | 4.6 | 2025-01-10 | On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption mig… |
CVE-2024-47520 | High | 7.6 | 2025-01-10 | A user with advanced report application access rights can perform actions for which they are not authorized |
CVE-2024-47519 | High | 8.3 | 2025-01-10 | Backup uploads to ETM subject to man-in-the-middle interception |
CVE-2024-47518 | Medium | 6.4 | 2025-01-10 | Specially constructed queries targeting ETM could discover active remote access sessions |
CVE-2024-47517 | Medium | 6.8 | 2025-01-10 | Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access |
CVE-2024-7095 | Medium | 4.3 | 2025-01-10 | On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted p… |
CVE-2024-5872 | Medium | 6.5 | 2025-01-10 | On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane be… |
CVE-2024-54998 | Medium | 5.4 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create. |
CVE-2024-54997 | Medium | 5.4 | 2025-01-10 | MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit. |
CVE-2024-54996 | High | 8.8 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/r… |
CVE-2024-54994 | Medium | 6.5 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relations… |
CVE-2024-6437 | Medium | 5.8 | 2025-01-10 | On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Fl… |
CVE-2024-33299 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the… |
CVE-2024-33298 | Medium | 6.1 | 2025-01-10 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in th… |
CVE-2024-33297 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the… |
CVE-2024-12847 | Critical | 9.8 | 2025-01-10 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating… |
CVE-2024-54910 | Medium | 4.7 | 2025-01-10 | Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. |
CVE-2024-6880 | | 2025-01-10 | During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as on… | |
CVE-2024-6662 | | 2025-01-10 | Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0"… | |
CVE-2024-57228 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57227 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function. |
CVE-2024-57226 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57225 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57224 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function. |
CVE-2024-57223 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function. |
CVE-2024-57222 | Medium | 6.3 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-54687 | Medium | 6.1 | 2025-01-10 | Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php. |
CVE-2024-57214 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57213 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function. |
CVE-2024-57212 | Medium | 5.1 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function. |
CVE-2024-57211 | High | 8.0 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function. |
CVE-2024-54849 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle a… |
CVE-2024-54848 | High | 7.4 | 2025-01-10 | Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle at… |
CVE-2024-54847 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-… |
CVE-2024-54846 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack. |
CVE-2024-56511 | Critical | 9.8 | 2025-01-10 | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter… |
CVE-2024-50807 | Medium | 6.1 | 2025-01-10 | Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. |
CVE-2024-46210 | High | 7.2 | 2025-01-10 | An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-29971 | Critical | 9.8 | 2025-01-10 | Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals. |
CVE-2024-29970 | Critical | 9.8 | 2025-01-10 | Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals. |
CVE-2024-25371 | High | 7.5 | 2025-01-10 | Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptions. |
CVE-2024-57687 | Critical | 9.8 | 2025-01-10 | An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to e… |
CVE-2024-57686 | Critical | 9.8 | 2025-01-10 | A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers… |
CVE-2024-41787 | Critical | 9.8 | 2025-01-10 | IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. B… |
CVE-2024-57823 | Critical | 9.3 | 2025-01-10 | In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path(). |