2024 CVEs (page 53)
Page 53 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56783 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level cgroup maximum depth i… |
CVE-2024-56782 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() acpi_dev_hid_match… |
CVE-2024-56780 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths quota writeback is… |
CVE-2024-56779 | Critical | 9.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(um… |
CVE-2024-56778 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check The retu… |
CVE-2024-56777 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check The return… |
CVE-2024-56776 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drm_atomic_get… |
CVE-2024-56775 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix handling of plane refcount [Why] The mechanism to backup and restore… |
CVE-2024-56774 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr… |
CVE-2024-56773 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: kunit: Fix potential null dereference in kunit_device_driver_test() kunit_kzalloc() may r… |
CVE-2024-56772 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite()… |
CVE-2024-56771 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information These four chips: *… |
CVE-2024-51442 | High | 8.8 | 2025-01-08 | Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration… |
CVE-2024-56770 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any… |
CVE-2024-55459 | Medium | 6.5 | 2025-01-08 | An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. |
CVE-2024-13187 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-55656 | High | 8.8 | 2025-01-08 | RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The… |
CVE-2024-55517 | High | 8.8 | 2025-01-08 | An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5. Input passed through the groupType parameter in /SCGController… |
CVE-2024-51737 | High | 7.0 | 2025-01-08 | RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executing FT.SEARCH or FT… |
CVE-2024-51480 | High | 7.0 | 2025-01-08 | RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by… |
CVE-2024-12337 | Medium | 6.1 | 2025-01-08 | The Shipping via Planzer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘processed-ids’ parameter in all versions… |
CVE-2024-11830 | Medium | 6.4 | 2025-01-08 | The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due… |
CVE-2024-11423 | High | 7.5 | 2025-01-08 | The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule… |
CVE-2024-12854 | High | 8.8 | 2025-01-08 | The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatical… |
CVE-2024-12853 | High | 8.8 | 2025-01-08 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in al… |
CVE-2024-12712 | Medium | 5.3 | 2025-01-08 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook fu… |
CVE-2024-9939 | High | 7.5 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This… |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2024-13186 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-13185 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-12855 | Medium | 4.3 | 2025-01-08 | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_a… |
CVE-2024-12328 | Medium | 6.4 | 2025-01-08 | The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to ins… |
CVE-2024-11939 | High | 7.5 | 2025-01-08 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and includ… |
CVE-2024-11350 | Critical | 9.8 | 2025-01-08 | The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plu… |
CVE-2024-13173 | High | 7.5 | 2025-01-08 | The health module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-12045 | Medium | 4.4 | 2025-01-08 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker titl… |
CVE-2024-11635 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cooki… |
CVE-2024-8002 | Medium | 4.3 | 2025-01-08 | A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Fil… |
CVE-2024-12852 | Medium | 6.4 | 2025-01-08 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in a… |
CVE-2024-12851 | Medium | 6.4 | 2025-01-08 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cros… |
CVE-2024-12584 | Medium | 4.3 | 2025-01-08 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-11613 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to… |
CVE-2024-12585 | Medium | 6.1 | 2025-01-08 | The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-10585 | Medium | 5.3 | 2025-01-08 | The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/… |
CVE-2024-10151 | Medium | 5.4 | 2025-01-08 | The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2024-54731 | Medium | 4.0 | 2025-01-08 | cpdf through 2.8 allows stack consumption via a crafted PDF document. |
CVE-2024-12205 | Medium | 6.4 | 2025-01-08 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and inc… |
CVE-2024-12030 | Medium | 6.5 | 2025-01-08 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all vers… |
CVE-2024-11271 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions i… |
CVE-2024-11270 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import… |
CVE-2024-56456 | Medium | 6.8 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56455 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56454 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56453 | Medium | 6.8 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56452 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56451 | High | 7.3 | 2025-01-08 | Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56450 | Medium | 6.3 | 2025-01-08 | Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56449 | Medium | 6.6 | 2025-01-08 | Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56448 | Medium | 6.7 | 2025-01-08 | Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-54121 | Medium | 6.2 | 2025-01-08 | Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-12713 | Medium | 5.3 | 2025-01-08 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2… |
CVE-2024-12521 | Medium | 6.4 | 2025-01-08 | The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and… |
CVE-2024-12112 | Medium | 6.4 | 2025-01-08 | The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to S… |
CVE-2024-11916 | High | 7.4 | 2025-01-08 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capabil… |
CVE-2024-11816 | High | 8.8 | 2025-01-08 | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability… |
CVE-2024-56447 | High | 7.8 | 2025-01-08 | Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-56446 | Medium | 4.0 | 2025-01-08 | Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56445 | Medium | 4.3 | 2025-01-08 | Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2024-56444 | High | 7.5 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56443 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56442 | Medium | 5.5 | 2025-01-08 | Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perfor… |
CVE-2024-56441 | Medium | 4.1 | 2025-01-08 | Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56440 | Medium | 6.2 | 2025-01-08 | Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-56439 | High | 7.5 | 2025-01-08 | Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56438 | Medium | 6.0 | 2025-01-08 | Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56437 | Medium | 5.7 | 2025-01-08 | Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2024-54120 | Medium | 4.1 | 2025-01-08 | Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnorma… |
CVE-2024-47934 | Medium | 5.3 | 2025-01-08 | Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to… |
CVE-2024-47239 | Medium | 6.5 | 2025-01-08 | Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could poten… |
CVE-2024-56436 | Medium | 5.5 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56435 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56434 | Medium | 4.4 | 2025-01-08 | UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device. |
CVE-2024-50603 | Critical | 10.0 | 2025-01-08 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS… |
CVE-2024-40679 | Medium | 5.5 | 2025-01-08 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be… |
CVE-2024-55218 | Medium | 6.1 | 2025-01-07 | IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter. |
CVE-2024-54819 | Critical | 9.1 | 2025-01-07 | I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php |
CVE-2024-53522 | High | 7.5 | 2025-01-07 | Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allo… |
CVE-2024-35532 | Critical | 9.1 | 2025-01-07 | An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading un… |
CVE-2024-40427 | High | 7.9 | 2025-01-07 | Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to exe… |
CVE-2024-55414 | Critical | 9.8 | 2025-01-07 | A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via spe… |
CVE-2024-55413 | High | 7.8 | 2025-01-07 | A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via… |
CVE-2024-55412 | High | 7.8 | 2025-01-07 | A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via s… |
CVE-2024-55411 | High | 8.8 | 2025-01-07 | An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOC… |
CVE-2024-54007 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54006 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-50660 | Critical | 9.8 | 2025-01-07 | File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality |
CVE-2024-50659 | Medium | 6.1 | 2025-01-07 | Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter… |
CVE-2024-50658 | Critical | 9.8 | 2025-01-07 | Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname p… |
CVE-2024-44450 | Medium | 5.4 | 2025-01-07 | Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190. |