2024 CVEs (page 57)
Page 57 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12583 | Critical | 9.9 | 2025-01-04 | The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 v… |
CVE-2024-11930 | Medium | 6.4 | 2025-01-04 | The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shor… |
CVE-2024-12701 | Medium | 6.1 | 2025-01-04 | The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all ve… |
CVE-2024-12545 | Medium | 5.4 | 2025-01-04 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-S… |
CVE-2024-12047 | Medium | 6.1 | 2025-01-04 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ paramet… |
CVE-2024-11974 | Medium | 6.1 | 2025-01-04 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofi… |
CVE-2024-10932 | High | 8.8 | 2025-01-04 | The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted in… |
CVE-2024-55897 | Medium | 4.3 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the coo… |
CVE-2024-55896 | Medium | 5.4 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to ga… |
CVE-2024-12237 | Medium | 4.3 | 2025-01-03 | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0… |
CVE-2024-11733 | High | 7.3 | 2025-01-03 | The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to… |
CVE-2024-13129 | High | 8.8 | 2025-01-03 | A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file a… |
CVE-2024-56332 | Medium | 5.3 | 2025-01-03 | Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is… |
CVE-2024-56412 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cr… |
CVE-2024-56411 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS)… |
CVE-2024-56410 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS)… |
CVE-2024-36613 | Medium | 6.2 | 2025-01-03 | FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service… |
CVE-2024-35365 | High | 8.8 | 2025-01-03 | FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. |
CVE-2024-56514 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-56513 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-56409 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56366 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56365 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized ref… |
CVE-2024-56408 | Medium | 5.4 | 2025-01-03 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vend… |
CVE-2024-56324 | High | 7.1 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups… |
CVE-2024-56322 | High | 7.2 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (p… |
CVE-2024-56321 | Low | 3.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup scrip… |
CVE-2024-56320 | High | 8.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the… |
CVE-2024-55507 | Critical | 9.8 | 2025-01-03 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component. |
CVE-2024-5591 | Medium | 4.3 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned i… |
CVE-2024-55078 | Critical | 9.8 | 2025-01-03 | An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uplo… |
CVE-2024-48814 | High | 7.5 | 2025-01-03 | SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause fu… |
CVE-2024-41780 | Medium | 4.2 | 2025-01-03 | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry. |
CVE-2024-9140 | Critical | 9.8 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS… |
CVE-2024-9138 | High | 7.2 | 2025-01-03 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability invol… |
CVE-2024-12132 | Medium | 4.3 | 2025-01-03 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-53842 | Critical | 9.8 | 2025-01-03 | In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execut… |
CVE-2024-53841 | High | 7.8 | 2025-01-03 | In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with n… |
CVE-2024-53840 | High | 7.8 | 2025-01-03 | there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2024-53839 | Medium | 5.5 | 2025-01-03 | In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disc… |
CVE-2024-53838 | High | 7.8 | 2025-01-03 | In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could le… |
CVE-2024-53837 | High | 7.8 | 2025-01-03 | In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege… |
CVE-2024-53836 | Medium | 6.7 | 2025-01-03 | In wbrc_bt_dev_write of wb_regon_coordinator.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privil… |
CVE-2024-53835 | High | 7.8 | 2025-01-03 | there is a possible biometric bypass due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2024-53834 | High | 7.5 | 2025-01-03 | In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote inf… |
CVE-2024-53833 | High | 7.8 | 2025-01-03 | In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalatio… |
CVE-2024-47032 | High | 7.8 | 2025-01-03 | In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation o… |
CVE-2024-11624 | High | 7.8 | 2025-01-03 | there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additional execution priv… |
CVE-2024-43769 | High | 7.8 | 2025-01-03 | In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in… |
CVE-2024-43768 | High | 7.8 | 2025-01-03 | In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2024-43767 | High | 8.8 | 2025-01-03 | In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code ex… |
CVE-2024-43764 | High | 7.8 | 2025-01-03 | In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege wi… |
CVE-2024-43762 | High | 7.8 | 2025-01-03 | In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escal… |
CVE-2024-43097 | High | 7.8 | 2025-01-03 | In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with n… |
CVE-2024-43077 | High | 7.8 | 2025-01-03 | In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privile… |
CVE-2024-8447 | Medium | 5.9 | 2025-01-02 | A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs… |
CVE-2024-48197 | Medium | 4.7 | 2025-01-02 | Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface. |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-11717 | | 2025-01-02 | Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a… | |
CVE-2024-11716 | | 2025-01-02 | While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticat… | |
CVE-2024-9950 | High | 7.8 | 2025-01-02 | A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary dire… |
CVE-2024-56414 | Medium | 5.5 | 2025-01-02 | Web installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-56413 | Medium | 6.1 | 2025-01-02 | Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55543 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55542 | Medium | 4.4 | 2025-01-02 | Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux… |
CVE-2024-55541 | Medium | 6.1 | 2025-01-02 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-55540 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-12907 | | 2025-01-02 | Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.a… | |
CVE-2024-56137 | Medium | 6.8 | 2025-01-02 | MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented… |
CVE-2024-55538 | Medium | 4.0 | 2025-01-02 | Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis Tru… |
CVE-2024-49385 | Medium | 5.5 | 2025-01-02 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acro… |
CVE-2024-38732 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through… |
CVE-2024-38731 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7. |
CVE-2024-37931 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1. |
CVE-2024-37925 | Medium | 5.4 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a… |
CVE-2024-37452 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1… |
CVE-2024-37438 | Medium | 5.4 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny T… |
CVE-2024-37241 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manag… |
CVE-2024-37237 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through… |
CVE-2024-13111 | Medium | 5.6 | 2025-01-02 | A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability… |
CVE-2024-13110 | Medium | 4.3 | 2025-01-02 | A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown… |
CVE-2024-56268 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook Post Grid Elementor Addon post-grid-elementor… |
CVE-2024-56257 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolPlugins Coins MarketCap coins-marketcap allows DOM-Ba… |
CVE-2024-56014 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markyis Cool Olivia allows Reflected XSS.This issue affec… |
CVE-2024-39623 | High | 8.8 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a thro… |
CVE-2024-38778 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <… |
CVE-2024-38764 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9. |
CVE-2024-13109 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects som… |
CVE-2024-13108 | Medium | 5.3 | 2025-01-02 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /g… |
CVE-2024-56302 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jorisderuiter ConvertCalculator for WordPress convertcalc… |
CVE-2024-56267 | High | 7.1 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive UK Map interactive-uk-map allows St… |
CVE-2024-56266 | Medium | 6.3 | 2025-01-02 | Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Functionality N… |
CVE-2024-56264 | Medium | 6.6 | 2025-01-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-56263 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio al… |
CVE-2024-56262 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Coaches gs-coach allows Stored XSS.This iss… |
CVE-2024-56261 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins Project Showcase gs-projects allows Stored XSS… |
CVE-2024-56260 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StorePlugin ShopElement shopelement allows Stored XSS.Thi… |
CVE-2024-56259 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This is… |
CVE-2024-56258 | Medium | 6.5 | 2025-01-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows Stored XS… |
CVE-2024-56255 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |