2024 CVEs (page 6)
Page 6 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58040 | Critical | 9.1 | 2025-09-30 | Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. |
CVE-2024-57412 | High | 7.5 | 2025-09-29 | An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. |
CVE-2024-13150 | Critical | 9.8 | 2025-09-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Services fayton.Pro ERP al… |
CVE-2024-5200 | Medium | 4.8 | 2025-09-29 | The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-43192 | Medium | 6.5 | 2025-09-27 | IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2024-48014 | High | 7.5 | 2025-09-25 | Dell BSAFE Micro Edition Suite, versions prior to 5.0.2.3 contain an Out-of-bounds Write vulnerability. An unauthenticated attacker with remote access could po… |
CVE-2024-58241 | High | 7.8 | 2025-09-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_*… |
CVE-2024-21935 | Medium | 5.0 | 2025-09-23 | Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files fr… |
CVE-2024-21927 | Medium | 5.0 | 2025-09-23 | Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfi… |
CVE-2024-6429 | Medium | 4.3 | 2025-09-23 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed t… |
CVE-2024-4598 | Medium | 6.5 | 2025-09-23 | An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able… |
CVE-2024-13990 | | 2025-09-19 | MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust crypt… | |
CVE-2024-48851 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This is… |
CVE-2024-25011 | Medium | 5.3 | 2025-09-18 | Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the i… |
CVE-2024-13151 | Critical | 9.8 | 2025-09-18 | CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industr… |
CVE-2024-48842 | High | 7.0 | 2025-09-17 | Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions |
CVE-2024-13174 | High | 8.6 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection. Thi… |
CVE-2024-13149 | Critical | 9.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor vu… |
CVE-2024-12796 | Medium | 5.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows… |
CVE-2024-12913 | High | 8.8 | 2025-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Megatek Communication System Azora Wireless Network Manag… |
CVE-2024-12367 | High | 8.6 | 2025-09-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issu… |
CVE-2024-45434 | Critical | 9.8 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the la… |
CVE-2024-45433 | Medium | 6.5 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. The specific flaw exists within the BlueSDK Bluetooth stack. The issue resul… |
CVE-2024-45432 | High | 7.5 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from… |
CVE-2024-45431 | Medium | 5.3 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results fr… |
CVE-2024-47120 | Medium | 6.4 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the h… |
CVE-2024-45671 | Medium | 5.9 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-45669 | Medium | 6.5 | 2025-09-10 | IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of spe… |
CVE-2024-45325 | Medium | 6.7 | 2025-09-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 th… |
CVE-2024-48341 | Low | 3.7 | 2025-09-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop |
CVE-2024-36354 | High | 7.5 | 2025-09-06 | Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-comp… |
CVE-2024-36352 | High | 8.4 | 2025-09-06 | Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or… |
CVE-2024-36346 | Medium | 6.0 | 2025-09-06 | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially caus… |
CVE-2024-36342 | High | 8.8 | 2025-09-06 | Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution. |
CVE-2024-36331 | Low | 3.2 | 2025-09-06 | Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of dat… |
CVE-2024-36326 | High | 8.4 | 2025-09-06 | Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting i… |
CVE-2024-21970 | Medium | 4.4 | 2025-09-06 | Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a l… |
CVE-2024-21947 | High | 7.5 | 2025-09-06 | Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrar… |
CVE-2024-0028 | Medium | 5.5 | 2025-09-05 | In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escal… |
CVE-2024-21977 | Low | 3.2 | 2025-09-05 | Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting… |
CVE-2024-49731 | Medium | 4.0 | 2025-09-04 | In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the… |
CVE-2024-40664 | Medium | 6.2 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2024-49714 | High | 7.8 | 2025-09-04 | In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privil… |
CVE-2024-49739 | Medium | 4.0 | 2025-09-04 | In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no… |
CVE-2024-43184 | Medium | 6.1 | 2025-09-04 | IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulne… |
CVE-2024-34598 | High | 7.7 | 2025-09-04 | Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store. |
CVE-2024-56190 | High | 7.8 | 2025-09-04 | In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of p… |
CVE-2024-56189 | Medium | 6.5 | 2025-09-04 | In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information… |
CVE-2024-13073 | Medium | 4.7 | 2025-09-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-Site Scripting (XSS… |
CVE-2024-13071 | Medium | 4.3 | 2025-09-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cross-Site Scripting (… |
CVE-2024-13068 | High | 7.3 | 2025-09-03 | Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17. |
CVE-2024-13066 | Medium | 4.3 | 2025-09-03 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects… |
CVE-2024-43166 | Critical | 9.8 | 2025-09-03 | Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to up… |
CVE-2024-43115 | High | 8.8 | 2025-09-03 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue aff… |
CVE-2024-13065 | Medium | 6.3 | 2025-09-03 | Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 -… |
CVE-2024-13064 | Medium | 4.3 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS… |
CVE-2024-13063 | Medium | 6.8 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing. This issue affects MyRezzta: from s2.02.02 befor… |
CVE-2024-32444 | Critical | 9.8 | 2025-09-03 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2024-49730 | High | 7.8 | 2025-09-02 | In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execut… |
CVE-2024-49728 | Medium | 5.5 | 2025-09-02 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local inform… |
CVE-2024-49722 | Medium | 5.5 | 2025-09-02 | In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information d… |
CVE-2024-49720 | High | 7.8 | 2025-09-02 | In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. T… |
CVE-2024-40653 | High | 7.3 | 2025-09-02 | In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the co… |
CVE-2024-51423 | Medium | 6.1 | 2025-09-02 | Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class paramete… |
CVE-2024-48705 | Medium | 6.5 | 2025-09-02 | Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the p… |
CVE-2024-12974 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross-Site Scripting (XS… |
CVE-2024-58259 | High | 8.2 | 2025-09-02 | A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authe… |
CVE-2024-52284 | High | 7.7 | 2025-09-02 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing cred… |
CVE-2024-12973 | Medium | 4.7 | 2025-09-02 | Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from… |
CVE-2024-12972 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross-Site Scripting (XS… |
CVE-2024-28988 | Critical | 9.8 | 2025-09-01 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2024-12925 | High | 7.3 | 2025-09-01 | Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP Response Splitting. This issue affects QR Menü: from s1.05… |
CVE-2024-12924 | Medium | 6.3 | 2025-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akınsoft QR Menü allows Forceful Browsing, Phishing. This issue affects QR Menü: from s1… |
CVE-2024-12914 | Medium | 4.3 | 2025-09-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akınsoft QR Menü allows Cross-Site Scripting (XSS)… |
CVE-2024-32832 | Critical | 9.8 | 2025-08-31 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-32589 | High | 7.1 | 2025-08-31 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-prod… |
CVE-2024-46484 | Critical | 9.8 | 2025-08-29 | TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. |
CVE-2024-12923 | Medium | 5.4 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2024-46917 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validation. This allows c… |
CVE-2024-46916 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is prop… |
CVE-2024-13342 | High | 8.1 | 2025-08-29 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' functi… |
CVE-2024-13987 | Medium | 5.9 | 2025-08-29 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users… |
CVE-2024-54568 | Medium | 4.3 | 2025-08-29 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. Parsing a maliciously crafted file may lead to an unexpected… |
CVE-2024-54554 | Medium | 5.5 | 2025-08-29 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
CVE-2024-44271 | Low | 3.3 | 2025-08-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to record the screen without an indicator. |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2024-48908 | | 2025-08-28 | lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code… | |
CVE-2024-49790 | Medium | 5.4 | 2025-08-28 | IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary J… |
CVE-2024-58240 | Critical | 9.8 | 2025-08-28 | In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, t… |
CVE-2024-13807 | High | 7.5 | 2025-08-28 | The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality d… |
CVE-2024-9648 | Medium | 6.1 | 2025-08-28 | The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class… |
CVE-2024-13985 | | 2025-08-27 | A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the… | |
CVE-2024-13984 | | 2025-08-27 | QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthent… | |
CVE-2024-13982 | | 2025-08-27 | SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the… | |
CVE-2024-13981 | | 2025-08-27 | LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its… | |
CVE-2024-13980 | | 2025-08-27 | H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoi… | |
CVE-2024-13979 | Critical | 9.8 | 2025-08-27 | A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via c… |
CVE-2024-37777 | High | 8.8 | 2025-08-27 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |
CVE-2024-49740 | Medium | 5.5 | 2025-08-26 | In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privi… |
CVE-2024-47192 | Medium | 5.3 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have… |