2024 CVEs (page 52)
Page 52 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43661 | Critical | 9.8 | 2025-01-09 | The <redacted>.so library, which is used by <redacted>, is vulnerable to a buffer overflow in the code that handles the deletion of certificates. This buffer o… |
CVE-2024-43660 | High | 7.5 | 2025-01-09 | The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 241… |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2024-43658 | | 2025-01-09 | Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmwar… | |
CVE-2024-43657 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43656 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43655 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… | |
CVE-2024-43654 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Inject… |
CVE-2024-43653 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43652 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… |
CVE-2024-43651 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… | |
CVE-2024-43650 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injecti… | |
CVE-2024-43649 | High | 8.8 | 2025-01-09 | Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firm… |
CVE-2024-43648 | High | 8.8 | 2025-01-09 | Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmwa… |
CVE-2024-40765 | Critical | 9.8 | 2025-01-09 | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and po… |
CVE-2024-12806 | Medium | 4.9 | 2025-01-09 | A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. |
CVE-2024-12805 | High | 7.2 | 2025-01-09 | A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. |
CVE-2024-12803 | High | 7.2 | 2025-01-09 | A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to cod… |
CVE-2024-53706 | High | 7.8 | 2025-01-09 | A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potenti… |
CVE-2024-53705 | High | 7.5 | 2025-01-09 | A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on… |
CVE-2024-53704 | Critical | 9.8 | 2025-01-09 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. |
CVE-2024-40762 | Critical | 9.8 | 2025-01-09 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predict… |
CVE-2024-13041 | Medium | 4.2 | 2025-01-09 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2024-6324 | Medium | 4.3 | 2025-01-09 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2024-12736 | Medium | 6.1 | 2025-01-09 | The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-12731 | Medium | 6.1 | 2025-01-09 | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-12717 | Medium | 4.8 | 2025-01-09 | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12715 | Medium | 6.1 | 2025-01-09 | The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12714 | Medium | 6.1 | 2025-01-09 | The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-10815 | Medium | 4.2 | 2025-01-09 | The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead… |
CVE-2024-56827 | Medium | 5.6 | 2025-01-09 | A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress u… |
CVE-2024-56826 | Medium | 5.6 | 2025-01-09 | A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress u… |
CVE-2024-13213 | Low | 3.5 | 2025-01-09 | A vulnerability classified as problematic was found in SingMR HouseRent 1.0. This vulnerability affects unknown code of the file /toAdminUpdateHousePage?hID=30… |
CVE-2024-13212 | Medium | 6.3 | 2025-01-09 | A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/hous… |
CVE-2024-13211 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/jav… |
CVE-2024-13210 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of… |
CVE-2024-13209 | Low | 2.4 | 2025-01-09 | A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&ca… |
CVE-2024-13206 | High | 7.8 | 2025-01-09 | A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp… |
CVE-2024-13205 | Low | 2.4 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-13204 | Medium | 5.5 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-13203 | Medium | 4.3 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads… |
CVE-2024-13202 | Low | 2.4 | 2025-01-09 | A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/… |
CVE-2024-13201 | Medium | 4.7 | 2025-01-09 | A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/mai… |
CVE-2024-13200 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/c… |
CVE-2024-37372 | Low | 3.6 | 2025-01-09 | The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subt… |
CVE-2024-27980 | High | 8.1 | 2025-01-09 | Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands a… |
CVE-2024-13199 | Low | 3.5 | 2025-01-09 | A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-13198 | Low | 3.7 | 2025-01-09 | A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulati… |
CVE-2024-13197 | Low | 3.5 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/ma… |
CVE-2024-13196 | Low | 3.5 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of… |
CVE-2024-13195 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java… |
CVE-2024-13194 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac… |
CVE-2024-13193 | Medium | 6.3 | 2025-01-08 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Im… |
CVE-2024-13192 | Low | 3.5 | 2025-01-08 | A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0. Affected is the function update of the file src/main/java/com/wdd/myblog… |
CVE-2024-13191 | Medium | 6.3 | 2025-01-08 | A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/w… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2024-53995 | | 2025-01-08 | SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c… | |
CVE-2024-52869 | Medium | 6.0 | 2025-01-08 | Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating… |
CVE-2024-13190 | Medium | 6.3 | 2025-01-08 | A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMappe… |
CVE-2024-12431 | Medium | 4.3 | 2025-01-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthori… |
CVE-2024-13189 | High | 7.3 | 2025-01-08 | A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo… |
CVE-2024-54818 | High | 8.8 | 2025-01-08 | SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list. |
CVE-2024-53526 | Medium | 6.4 | 2025-01-08 | composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function. |
CVE-2024-13188 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-6350 | Medium | 6.5 | 2025-01-08 | A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automat… |
CVE-2024-56787 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel c… |
CVE-2024-56785 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a Fix the dtc warnings: arc… |
CVE-2024-56784 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adding array index check to prevent memory corruption [Why & How] Array… |
CVE-2024-56783 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level cgroup maximum depth i… |
CVE-2024-56782 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() acpi_dev_hid_match… |
CVE-2024-56780 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths quota writeback is… |
CVE-2024-56779 | Critical | 9.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(um… |
CVE-2024-56778 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check The retu… |
CVE-2024-56777 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check The return… |
CVE-2024-56776 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drm_atomic_get… |
CVE-2024-56775 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix handling of plane refcount [Why] The mechanism to backup and restore… |
CVE-2024-56774 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr… |
CVE-2024-56773 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: kunit: Fix potential null dereference in kunit_device_driver_test() kunit_kzalloc() may r… |
CVE-2024-56772 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite()… |
CVE-2024-56771 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information These four chips: *… |
CVE-2024-51442 | High | 8.8 | 2025-01-08 | Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration… |
CVE-2024-56770 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any… |
CVE-2024-55459 | Medium | 6.5 | 2025-01-08 | An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. |
CVE-2024-13187 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-55656 | High | 8.8 | 2025-01-08 | RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The… |
CVE-2024-55517 | High | 8.8 | 2025-01-08 | An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5. Input passed through the groupType parameter in /SCGController… |
CVE-2024-51737 | High | 7.0 | 2025-01-08 | RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executing FT.SEARCH or FT… |
CVE-2024-51480 | High | 7.0 | 2025-01-08 | RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by… |
CVE-2024-12337 | Medium | 6.1 | 2025-01-08 | The Shipping via Planzer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘processed-ids’ parameter in all versions… |
CVE-2024-11830 | Medium | 6.4 | 2025-01-08 | The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due… |
CVE-2024-11423 | High | 7.5 | 2025-01-08 | The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule… |
CVE-2024-12854 | High | 8.8 | 2025-01-08 | The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatical… |
CVE-2024-12853 | High | 8.8 | 2025-01-08 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in al… |
CVE-2024-12712 | Medium | 5.3 | 2025-01-08 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook fu… |
CVE-2024-9939 | High | 7.5 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This… |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2024-13186 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-13185 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-12855 | Medium | 4.3 | 2025-01-08 | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_a… |