2024 CVEs (page 57)
Page 57 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41780 | Medium | 4.2 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry. |
CVE-2024-9140 | Critical | 9.8 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS… |
CVE-2024-9138 | High | 7.2 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability invol… |
CVE-2024-12132 | Medium | 4.3 | 2025-01-03 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-53842 | Critical | 9.8 | 2025-01-03 | In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execut… |
CVE-2024-53841 | High | 7.8 | 2025-01-03 | In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with n… |
CVE-2024-53840 | High | 7.8 | 2025-01-03 | there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2024-53839 | Medium | 5.5 | 2025-01-03 | In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disc… |
CVE-2024-53838 | High | 7.8 | 2025-01-03 | In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could le… |
CVE-2024-53837 | High | 7.8 | 2025-01-03 | In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege… |
CVE-2024-53836 | Medium | 6.7 | 2025-01-03 | In wbrc_bt_dev_write of wb_regon_coordinator.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privil… |
CVE-2024-53835 | High | 7.8 | 2025-01-03 | there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2024-53834 | High | 7.5 | 2025-01-03 | In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote inf… |
CVE-2024-53833 | High | 7.8 | 2025-01-03 | In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalatio… |
CVE-2024-47032 | High | 7.8 | 2025-01-03 | In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation o… |
CVE-2024-11624 | High | 7.8 | 2025-01-03 | there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additional execution priv… |
CVE-2024-43769 | High | 7.8 | 2025-01-03 | In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in… |
CVE-2024-43768 | High | 7.8 | 2025-01-03 | In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2024-43767 | High | 8.8 | 2025-01-03 | In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code ex… |
CVE-2024-43764 | High | 7.8 | 2025-01-03 | In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege wi… |
CVE-2024-43762 | High | 7.8 | 2025-01-03 | In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escal… |
CVE-2024-43097 | High | 7.8 | 2025-01-03 | In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with n… |
CVE-2024-43077 | High | 7.8 | 2025-01-03 | In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privile… |
CVE-2024-8447 | Medium | 5.9 | 2025-01-02 | A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs… |
CVE-2024-48197 | Medium | 4.7 | 2025-01-02 | Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface. |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-11717 | | 2025-01-02 | Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a… | |
CVE-2024-11716 | | 2025-01-02 | While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticat… | |
CVE-2024-9950 | High | 7.8 | 2025-01-02 | A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary dire… |
CVE-2024-56414 | Medium | 5.5 | 2025-01-02 | Web installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-56413 | Medium | 6.1 | 2025-01-02 | Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55543 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55542 | Medium | 4.4 | 2025-01-02 | Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux… |
CVE-2024-55541 | Medium | 6.1 | 2025-01-02 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-55540 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-12907 | | 2025-01-02 | Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.a… | |
CVE-2024-56137 | Medium | 6.8 | 2025-01-02 | MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented… |
CVE-2024-55538 | Medium | 4.0 | 2025-01-02 | Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis Tru… |
CVE-2024-49385 | Medium | 5.5 | 2025-01-02 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acro… |
CVE-2024-38732 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through… |
CVE-2024-38731 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7. |
CVE-2024-37931 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1. |
CVE-2024-37925 | Medium | 5.4 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a… |
CVE-2024-37452 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1… |
CVE-2024-37438 | Medium | 5.4 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny T… |
CVE-2024-37241 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manag… |
CVE-2024-37237 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through… |
CVE-2024-13111 | Medium | 5.6 | 2025-01-02 | A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability… |
CVE-2024-13110 | Medium | 4.3 | 2025-01-02 | A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown… |
CVE-2024-56268 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook Post Grid Elementor Addon post-grid-elementor… |
CVE-2024-56257 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolPlugins Coins MarketCap coins-marketcap allows DOM-Ba… |
CVE-2024-56014 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markyis Cool Olivia allows Reflected XSS.This issue affec… |
CVE-2024-39623 | High | 8.8 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a thro… |
CVE-2024-38778 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <… |
CVE-2024-38764 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9. |
CVE-2024-13109 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects som… |
CVE-2024-13108 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /g… |
CVE-2024-56302 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jorisderuiter ConvertCalculator for WordPress convertcalc… |
CVE-2024-56267 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive UK Map interactive-uk-map allows St… |
CVE-2024-56266 | Medium | 6.3 | 2025-01-02 | Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Functionality N… |
CVE-2024-56264 | Medium | 6.6 | 2025-01-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-56263 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio al… |
CVE-2024-56262 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Coaches gs-coach allows Stored XSS.This iss… |
CVE-2024-56261 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins Project Showcase gs-projects allows Stored XSS… |
CVE-2024-56260 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StorePlugin ShopElement shopelement allows Stored XSS.Thi… |
CVE-2024-56259 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This is… |
CVE-2024-56258 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows Stored XS… |
CVE-2024-56255 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-56254 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows S… |
CVE-2024-56253 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured… |
CVE-2024-56252 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.Thi… |
CVE-2024-56251 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affe… |
CVE-2024-56250 | High | 7.6 | 2025-01-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics… |
CVE-2024-56249 | Critical | 9.1 | 2025-01-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-56248 | Medium | 4.9 | 2025-01-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Path Traversa… |
CVE-2024-56247 | High | 7.6 | 2025-01-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Inject… |
CVE-2024-56246 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor a… |
CVE-2024-56245 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress pr… |
CVE-2024-56244 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in WP Royal Ashe Extra ashe-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-56243 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-56242 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allo… |
CVE-2024-56241 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates… |
CVE-2024-56240 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pronamic Pronamic Google Maps pronamic-google-maps allows… |
CVE-2024-56239 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows St… |
CVE-2024-56238 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in QuantumCloud Floating Action Buttons floating-action-buttons allows Accessing Functionality Not Properly Constrained by… |
CVE-2024-56237 | Medium | 5.9 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2024-56236 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in Juni Hestia Nginx Cache hestia-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-56026 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg – SiteOrigin Simple Proxy simple-proxy allows Reflec… |
CVE-2024-56025 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adworkmedia AdWork Media EZ Content Locker adwork-media-e… |
CVE-2024-56024 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-w… |
CVE-2024-56023 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickp… |
CVE-2024-56022 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress Monsters Preloader by WordPress Monsters preloa… |
CVE-2024-56018 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Section Editing bu-section-editing allows… |
CVE-2024-43927 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects… |
CVE-2024-38790 | Medium | 6.5 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Requ… |
CVE-2024-38789 | Medium | 5.4 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegr… |
CVE-2024-38766 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: fr… |
CVE-2024-38765 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a throu… |
CVE-2024-38763 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Ver… |
CVE-2024-38762 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: fr… |