2024 CVEs (page 6)
Page 6 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-14008 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supp… |
CVE-2024-14006 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructi… |
CVE-2024-14005 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wiza… |
CVE-2024-14004 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user… |
CVE-2024-14003 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient… |
CVE-2024-14002 | Medium | 5.5 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted… |
CVE-2024-14001 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or esca… |
CVE-2024-14000 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or esca… |
CVE-2024-13999 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticat… |
CVE-2024-13996 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-exis… |
CVE-2024-13995 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed pa… |
CVE-2024-13994 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, an… |
CVE-2024-13993 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Ins… |
CVE-2024-14012 | | 2025-10-29 | Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a re… | |
CVE-2024-58269 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is… |
CVE-2024-45162 | Critical | 9.8 | 2025-10-29 | A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field. |
CVE-2024-45161 | Medium | 4.6 | 2025-10-29 | A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpReques… |
CVE-2024-58274 | High | 8.3 | 2025-10-22 | Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installa… |
CVE-2024-55568 | High | 7.5 | 2025-10-20 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110… |
CVE-2024-31573 | Medium | 4.0 | 2025-10-17 | XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because… |
CVE-2024-42192 | Medium | 5.5 | 2025-10-16 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. |
CVE-2024-56143 | High | 8.2 | 2025-10-16 | Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does… |
CVE-2024-13991 | | 2025-10-15 | Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPat… | |
CVE-2024-50571 | High | 7.2 | 2025-10-14 | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9… |
CVE-2024-48891 | High | 7.0 | 2025-10-14 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 th… |
CVE-2024-47569 | Medium | 4.3 | 2025-10-14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all v… |
CVE-2024-33507 | High | 7.4 | 2025-10-14 | An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all… |
CVE-2024-26008 | Medium | 5.3 | 2025-10-14 | An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4… |
CVE-2024-44088 | Medium | 6.1 | 2025-10-14 | Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in… |
CVE-2024-56804 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2024-58267 | High | 8.0 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The cu… |
CVE-2024-58260 | High | 7.6 | 2025-10-02 | A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with upda… |
CVE-2024-57494 | Medium | 6.5 | 2025-10-01 | Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter. |
CVE-2024-55017 | High | 7.5 | 2025-09-30 | Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to intercept authorization… |
CVE-2024-58040 | Critical | 9.1 | 2025-09-30 | Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. |
CVE-2024-57412 | High | 7.5 | 2025-09-29 | An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. |
CVE-2024-13150 | Critical | 9.8 | 2025-09-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Services fayton.Pro ERP al… |
CVE-2024-5200 | Medium | 4.8 | 2025-09-29 | The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-43192 | Medium | 6.5 | 2025-09-27 | IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2024-48014 | High | 7.5 | 2025-09-25 | Dell BSAFE Micro Edition Suite, versions prior to 5.0.2.3 contain an Out-of-bounds Write vulnerability. An unauthenticated attacker with remote access could po… |
CVE-2024-58241 | High | 7.8 | 2025-09-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_*… |
CVE-2024-21935 | Medium | 5.0 | 2025-09-23 | Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files fr… |
CVE-2024-21927 | Medium | 5.0 | 2025-09-23 | Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfi… |
CVE-2024-6429 | Medium | 4.3 | 2025-09-23 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed t… |
CVE-2024-4598 | Medium | 6.5 | 2025-09-23 | An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able… |
CVE-2024-13990 | | 2025-09-19 | MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust crypt… | |
CVE-2024-48851 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This is… |
CVE-2024-25011 | Medium | 5.3 | 2025-09-18 | Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the i… |
CVE-2024-13151 | Critical | 9.8 | 2025-09-18 | CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industr… |
CVE-2024-48842 | High | 7.0 | 2025-09-17 | Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions |
CVE-2024-13174 | High | 8.6 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection. Thi… |
CVE-2024-13149 | Critical | 9.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor vu… |
CVE-2024-12796 | Medium | 5.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows… |
CVE-2024-12913 | High | 8.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Megatek Communication System Azora Wireless Network Manag… |
CVE-2024-12367 | High | 8.6 | 2025-09-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issu… |
CVE-2024-45434 | Critical | 9.8 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the la… |
CVE-2024-45433 | Medium | 6.5 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. The specific flaw exists within the BlueSDK Bluetooth stack. The issue resul… |
CVE-2024-45432 | High | 7.5 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from… |
CVE-2024-45431 | Medium | 5.3 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results fr… |
CVE-2024-47120 | Medium | 6.4 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the h… |
CVE-2024-45671 | Medium | 5.9 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-45669 | Medium | 6.5 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of spe… |
CVE-2024-45325 | Medium | 6.7 | 2025-09-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 th… |
CVE-2024-48341 | Low | 3.7 | 2025-09-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop |
CVE-2024-36354 | High | 7.5 | 2025-09-06 | Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-comp… |
CVE-2024-36352 | High | 8.4 | 2025-09-06 | Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or… |
CVE-2024-36346 | Medium | 6.0 | 2025-09-06 | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially caus… |
CVE-2024-36342 | High | 8.8 | 2025-09-06 | Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution. |
CVE-2024-36331 | Low | 3.2 | 2025-09-06 | Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of dat… |
CVE-2024-36326 | High | 8.4 | 2025-09-06 | Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting i… |
CVE-2024-21970 | Medium | 4.4 | 2025-09-06 | Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a l… |
CVE-2024-21947 | High | 7.5 | 2025-09-06 | Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrar… |
CVE-2024-0028 | Medium | 5.5 | 2025-09-05 | In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escal… |
CVE-2024-21977 | Low | 3.2 | 2025-09-05 | Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting… |
CVE-2024-49731 | Medium | 4.0 | 2025-09-04 | In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the… |
CVE-2024-40664 | Medium | 6.2 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2024-49714 | High | 7.8 | 2025-09-04 | In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privil… |
CVE-2024-49739 | Medium | 4.0 | 2025-09-04 | In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no… |
CVE-2024-43184 | Medium | 6.1 | 2025-09-04 | IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulne… |
CVE-2024-34598 | High | 7.7 | 2025-09-04 | Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store. |
CVE-2024-56190 | High | 7.8 | 2025-09-04 | In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of p… |
CVE-2024-56189 | Medium | 6.5 | 2025-09-04 | In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information… |
CVE-2024-13073 | Medium | 4.7 | 2025-09-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-Site Scripting (XSS… |
CVE-2024-13071 | Medium | 4.3 | 2025-09-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cross-Site Scripting (… |
CVE-2024-13068 | High | 7.3 | 2025-09-03 | Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17. |
CVE-2024-13066 | Medium | 4.3 | 2025-09-03 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects… |
CVE-2024-43166 | Critical | 9.8 | 2025-09-03 | Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to up… |
CVE-2024-43115 | High | 8.8 | 2025-09-03 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue aff… |
CVE-2024-13065 | Medium | 6.3 | 2025-09-03 | Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 -… |
CVE-2024-13064 | Medium | 4.3 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS… |
CVE-2024-13063 | Medium | 6.8 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing. This issue affects MyRezzta: from s2.02.02 befor… |
CVE-2024-32444 | Critical | 9.8 | 2025-09-03 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2024-49730 | High | 7.8 | 2025-09-02 | In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execut… |
CVE-2024-49728 | Medium | 5.5 | 2025-09-02 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local inform… |
CVE-2024-49722 | Medium | 5.5 | 2025-09-02 | In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information d… |
CVE-2024-49720 | High | 7.8 | 2025-09-02 | In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. T… |
CVE-2024-40653 | High | 7.3 | 2025-09-02 | In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the co… |
CVE-2024-51423 | Medium | 6.1 | 2025-09-02 | Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class paramete… |
CVE-2024-48705 | Medium | 6.5 | 2025-09-02 | Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the p… |
CVE-2024-12974 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross-Site Scripting (XS… |