2024 CVEs (page 56)
Page 56 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55076 | High | 8.1 | 2025-01-06 | Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. |
CVE-2024-55075 | Medium | 4.3 | 2025-01-06 | Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec… |
CVE-2024-55074 | High | 8.8 | 2025-01-06 | The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issu… |
CVE-2024-55408 | Medium | 5.3 | 2025-01-06 | An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL re… |
CVE-2024-55407 | High | 7.8 | 2025-01-06 | An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplyin… |
CVE-2024-46209 | Medium | 5.4 | 2025-01-06 | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or… |
CVE-2024-35498 | Medium | 6.1 | 2025-01-06 | A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-56828 | Critical | 9.8 | 2025-01-06 | File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base6… |
CVE-2024-55629 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urge… |
CVE-2024-55628 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name… |
CVE-2024-55627 | Medium | 5.9 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP s… |
CVE-2024-55626 | Low | 3.3 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file p… |
CVE-2024-55529 | Critical | 9.8 | 2025-01-06 | Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template. |
CVE-2024-54880 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk. |
CVE-2024-54879 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely. |
CVE-2024-46622 | Critical | 9.8 | 2025-01-06 | An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18… |
CVE-2024-46073 | Medium | 6.1 | 2025-01-06 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "n… |
CVE-2024-56769 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1]… |
CVE-2024-56768 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processo… |
CVE-2024-56767 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset… |
CVE-2024-56766 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was convert… |
CVE-2024-56765 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is… |
CVE-2024-56764 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), g… |
CVE-2024-56763 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it wil… |
CVE-2024-56761 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU… |
CVE-2024-56760 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pc… |
CVE-2024-56759 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tr… |
CVE-2024-56758 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_f… |
CVE-2024-56757 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an s… |
CVE-2024-55605 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to t… |
CVE-2024-51472 | Low | 3.1 | 2025-01-06 | IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerab… |
CVE-2024-47475 | Medium | 5.0 | 2025-01-06 | Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally authenticated attacker… |
CVE-2024-51112 | Medium | 6.1 | 2025-01-06 | Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script |
CVE-2024-51111 | Medium | 4.1 | 2025-01-06 | Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of… |
CVE-2024-31914 | Medium | 6.4 | 2025-01-06 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerabili… |
CVE-2024-31913 | Medium | 5.5 | 2025-01-06 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerabili… |
CVE-2024-8474 | High | 7.5 | 2025-01-06 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthoriz… |
CVE-2024-5594 | Critical | 9.1 | 2025-01-06 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending… |
CVE-2024-12970 | Low | 3.9 | 2025-01-06 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Comm… |
CVE-2024-45559 | Medium | 5.5 | 2025-01-06 | Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend. |
CVE-2024-45558 | High | 7.5 | 2025-01-06 | Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length. |
CVE-2024-45555 | High | 8.4 | 2025-01-06 | Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected int… |
CVE-2024-45553 | High | 7.8 | 2025-01-06 | Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it… |
CVE-2024-45550 | High | 7.8 | 2025-01-06 | Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls. |
CVE-2024-45548 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call. |
CVE-2024-45547 | High | 7.8 | 2025-01-06 | Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality. |
CVE-2024-45546 | High | 7.8 | 2025-01-06 | Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space. |
CVE-2024-45542 | High | 7.8 | 2025-01-06 | Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. |
CVE-2024-45541 | High | 7.8 | 2025-01-06 | Memory corruption when IOCTL call is invoked from user-space to read board data. |
CVE-2024-43064 | High | 7.5 | 2025-01-06 | Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. |
CVE-2024-43063 | Medium | 6.1 | 2025-01-06 | information disclosure while invoking the mailbox read API. |
CVE-2024-33067 | Medium | 6.1 | 2025-01-06 | Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. |
CVE-2024-33061 | Medium | 6.8 | 2025-01-06 | Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process. |
CVE-2024-33059 | Medium | 6.7 | 2025-01-06 | Memory corruption while processing frame command IOCTL calls. |
CVE-2024-33055 | Medium | 6.7 | 2025-01-06 | Memory corruption while invoking IOCTL calls to unmap the DMA buffers. |
CVE-2024-33041 | Medium | 6.7 | 2025-01-06 | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
CVE-2024-23366 | Medium | 6.6 | 2025-01-06 | Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size. |
CVE-2024-21464 | High | 8.4 | 2025-01-06 | Memory corruption while processing IPA statistics, when there are no active clients registered. |
CVE-2024-12311 | Medium | 6.5 | 2025-01-06 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing… |
CVE-2024-12302 | Medium | 6.1 | 2025-01-06 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform S… |
CVE-2024-11849 | Medium | 6.1 | 2025-01-06 | The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-11356 | Medium | 6.1 | 2025-01-06 | The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated u… |
CVE-2024-20154 | High | 8.8 | 2025-01-06 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue bas… |
CVE-2024-20153 | High | 7.5 | 2025-01-06 | In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no addition… |
CVE-2024-20152 | Medium | 4.4 | 2025-01-06 | In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service if a malicious actor… |
CVE-2024-20151 | Medium | 6.7 | 2025-01-06 | In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has a… |
CVE-2024-20150 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. Us… |
CVE-2024-20149 | High | 7.5 | 2025-01-06 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2024-20148 | Critical | 9.8 | 2025-01-06 | In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no… |
CVE-2024-20146 | High | 8.1 | 2025-01-06 | In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2024-20145 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20144 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20143 | Medium | 6.6 | 2025-01-06 | In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical… |
CVE-2024-20140 | Medium | 6.7 | 2025-01-06 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2024-20105 | Medium | 6.7 | 2025-01-06 | In m4u, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2024-13145 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com… |
CVE-2024-13144 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/sit… |
CVE-2024-13143 | Low | 2.4 | 2025-01-06 | A vulnerability was found in ZeroWdd studentmanager 1.0. It has been rated as problematic. This issue affects the function submitAddPermission of the file src/… |
CVE-2024-13142 | Low | 2.4 | 2025-01-05 | A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file… |
CVE-2024-13141 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the c… |
CVE-2024-13140 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload… |
CVE-2024-13139 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/… |
CVE-2024-13138 | Medium | 4.7 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/j… |
CVE-2024-13137 | Low | 2.4 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been classified as problematic. This affects the function RestResponse of the file src/main/java… |
CVE-2024-13136 | Medium | 6.3 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/mai… |
CVE-2024-13135 | Low | 3.5 | 2025-01-05 | A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-13134 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/mai… |
CVE-2024-13133 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the… |
CVE-2024-13132 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the com… |
CVE-2024-13130 | Medium | 4.3 | 2025-01-05 | A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by… |
CVE-2024-41768 | Medium | 6.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the con… |
CVE-2024-41767 | High | 7.3 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statemen… |
CVE-2024-41766 | High | 7.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular express… |
CVE-2024-41765 | Medium | 6.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2024-41763 | Medium | 5.9 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-10957 | High | 8.8 | 2025-01-04 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserializa… |
CVE-2024-12475 | Medium | 6.4 | 2025-01-04 | The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient in… |
CVE-2024-12279 | Medium | 6.1 | 2025-01-04 | The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing… |
CVE-2024-12195 | Medium | 6.5 | 2025-01-04 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection… |
CVE-2024-12221 | Medium | 6.1 | 2025-01-04 | The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and… |