2024 CVEs (page 56)
Page 56 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51112 | Medium | 6.1 | 2025-01-06 | Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script |
CVE-2024-51111 | Medium | 4.1 | 2025-01-06 | Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of… |
CVE-2024-31914 | Medium | 6.4 | 2025-01-06 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerabili… |
CVE-2024-31913 | Medium | 5.5 | 2025-01-06 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerabili… |
CVE-2024-8474 | High | 7.5 | 2025-01-06 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthoriz… |
CVE-2024-5594 | Critical | 9.1 | 2025-01-06 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending… |
CVE-2024-12970 | Low | 3.9 | 2025-01-06 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Comm… |
CVE-2024-45559 | Medium | 5.5 | 2025-01-06 | Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend. |
CVE-2024-45558 | High | 7.5 | 2025-01-06 | Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length. |
CVE-2024-45555 | High | 8.4 | 2025-01-06 | Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected int… |
CVE-2024-45553 | High | 7.8 | 2025-01-06 | Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it… |
CVE-2024-45550 | High | 7.8 | 2025-01-06 | Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls. |
CVE-2024-45548 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call. |
CVE-2024-45547 | High | 7.8 | 2025-01-06 | Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality. |
CVE-2024-45546 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space. |
CVE-2024-45542 | High | 7.8 | 2025-01-06 | Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. |
CVE-2024-45541 | High | 7.8 | 2025-01-06 | Memory corruption when IOCTL call is invoked from user-space to read board data. |
CVE-2024-43064 | High | 7.5 | 2025-01-06 | Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. |
CVE-2024-43063 | Medium | 6.1 | 2025-01-06 | information disclosure while invoking the mailbox read API. |
CVE-2024-33067 | Medium | 6.1 | 2025-01-06 | Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. |
CVE-2024-33061 | Medium | 6.8 | 2025-01-06 | Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process. |
CVE-2024-33059 | Medium | 6.7 | 2025-01-06 | Memory corruption while processing frame command IOCTL calls. |
CVE-2024-33055 | Medium | 6.7 | 2025-01-06 | Memory corruption while invoking IOCTL calls to unmap the DMA buffers. |
CVE-2024-33041 | Medium | 6.7 | 2025-01-06 | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
CVE-2024-23366 | Medium | 6.6 | 2025-01-06 | Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size. |
CVE-2024-21464 | High | 8.4 | 2025-01-06 | Memory corruption while processing IPA statistics, when there are no active clients registered. |
CVE-2024-12311 | Medium | 6.5 | 2025-01-06 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing… |
CVE-2024-12302 | Medium | 6.1 | 2025-01-06 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform S… |
CVE-2024-11849 | Medium | 6.1 | 2025-01-06 | The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-11356 | Medium | 6.1 | 2025-01-06 | The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated u… |
CVE-2024-20154 | High | 8.8 | 2025-01-06 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue bas… |
CVE-2024-20153 | High | 7.5 | 2025-01-06 | In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no addition… |
CVE-2024-20152 | Medium | 4.4 | 2025-01-06 | In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service if a malicious actor… |
CVE-2024-20151 | Medium | 6.7 | 2025-01-06 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has a… |
CVE-2024-20150 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. Us… |
CVE-2024-20149 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2024-20148 | Critical | 9.8 | 2025-01-06 | In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no… |
CVE-2024-20146 | High | 8.1 | 2025-01-06 | In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2024-20145 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20144 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20143 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20140 | Medium | 6.7 | 2025-01-06 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2024-20105 | Medium | 6.7 | 2025-01-06 | In m4u, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2024-13145 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com… |
CVE-2024-13144 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/sit… |
CVE-2024-13143 | Low | 2.4 | 2025-01-06 | A vulnerability was found in ZeroWdd studentmanager 1.0. It has been rated as problematic. This issue affects the function submitAddPermission of the file src/… |
CVE-2024-13142 | Low | 2.4 | 2025-01-05 | A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file… |
CVE-2024-13141 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the c… |
CVE-2024-13140 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload… |
CVE-2024-13139 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/… |
CVE-2024-13138 | Medium | 4.7 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/j… |
CVE-2024-13137 | Low | 2.4 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been classified as problematic. This affects the function RestResponse of the file src/main/java… |
CVE-2024-13136 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/mai… |
CVE-2024-13135 | Low | 3.5 | 2025-01-05 | A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-13134 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/mai… |
CVE-2024-13133 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the… |
CVE-2024-13132 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the com… |
CVE-2024-13130 | Medium | 4.3 | 2025-01-05 | A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by… |
CVE-2024-41768 | Medium | 6.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the con… |
CVE-2024-41767 | High | 7.3 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statemen… |
CVE-2024-41766 | High | 7.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular express… |
CVE-2024-41765 | Medium | 6.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2024-41763 | Medium | 5.9 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-10957 | High | 8.8 | 2025-01-04 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserializa… |
CVE-2024-12475 | Medium | 6.4 | 2025-01-04 | The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient in… |
CVE-2024-12279 | Medium | 6.1 | 2025-01-04 | The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing… |
CVE-2024-12195 | Medium | 6.5 | 2025-01-04 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection… |
CVE-2024-12221 | Medium | 6.1 | 2025-01-04 | The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and… |
CVE-2024-12583 | Critical | 9.9 | 2025-01-04 | The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 v… |
CVE-2024-11930 | Medium | 6.4 | 2025-01-04 | The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shor… |
CVE-2024-12701 | Medium | 6.1 | 2025-01-04 | The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all ve… |
CVE-2024-12545 | Medium | 5.4 | 2025-01-04 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-S… |
CVE-2024-12047 | Medium | 6.1 | 2025-01-04 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ paramet… |
CVE-2024-11974 | Medium | 6.1 | 2025-01-04 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofi… |
CVE-2024-10932 | High | 8.8 | 2025-01-04 | The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted in… |
CVE-2024-55897 | Medium | 4.3 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the coo… |
CVE-2024-55896 | Medium | 5.4 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to ga… |
CVE-2024-12237 | Medium | 4.3 | 2025-01-03 | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0… |
CVE-2024-11733 | High | 7.3 | 2025-01-03 | The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to… |
CVE-2024-13129 | High | 8.8 | 2025-01-03 | A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file a… |
CVE-2024-56332 | Medium | 5.3 | 2025-01-03 | Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is… |
CVE-2024-56412 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cr… |
CVE-2024-56411 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS)… |
CVE-2024-56410 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS)… |
CVE-2024-36613 | Medium | 6.2 | 2025-01-03 | FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service… |
CVE-2024-35365 | High | 8.8 | 2025-01-03 | FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. |
CVE-2024-56514 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-56513 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-56409 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56366 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56365 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56408 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vend… |
CVE-2024-56324 | High | 7.1 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups… |
CVE-2024-56322 | High | 7.2 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (p… |
CVE-2024-56321 | Low | 3.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup scrip… |
CVE-2024-56320 | High | 8.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the… |
CVE-2024-55507 | Critical | 9.8 | 2025-01-03 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component. |
CVE-2024-5591 | Medium | 4.3 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned i… |
CVE-2024-55078 | Critical | 9.8 | 2025-01-03 | An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uplo… |
CVE-2024-48814 | High | 7.5 | 2025-01-03 | SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause fu… |