2024 CVEs (page 65)
Page 65 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12745 | High | 8.0 | 2024-12-24 | A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metad… |
CVE-2024-12744 | High | 8.0 | 2024-12-24 | A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadat… |
CVE-2024-53163 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_420xx - fix off by one in uof_get_name() This is called from uof_get_name… |
CVE-2024-53162 | High | 7.1 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_4xxx - fix off by one in uof_get_name() The fw_objs[] array has "num_objs… |
CVE-2024-53161 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info… |
CVE-2024-53160 | Medium | 4.7 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu KCSAN reports a data race when… |
CVE-2024-53158 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() This loop is supposed to… |
CVE-2024-53157 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash… |
CVE-2024-53156 | High | 7.8 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the follo… |
CVE-2024-53155 | High | 7.1 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the followin… |
CVE-2024-53154 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: clk: clk-apple-nco: Add NULL check in applnco_probe Add NULL check in applnco_probe, to h… |
CVE-2024-53153 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() Currently, the endpo… |
CVE-2024-53152 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Currently, the… |
CVE-2024-53151 | High | 7.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrd… |
CVE-2024-53150 | High | 7.1 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio… |
CVE-2024-53149 | Medium | 4.6 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix off-by-one in connector_status UCSI connector's indices star… |
CVE-2024-53148 | High | 7.8 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded be… |
CVE-2024-53147 | High | 7.8 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is… |
CVE-2024-53146 | Critical | 9.1 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "… |
CVE-2024-53145 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: um: Fix potential integer overflow during physmem setup This issue happens when the real… |
CVE-2024-43441 | Critical | 9.8 | 2024-12-24 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0… |
CVE-2024-12268 | Medium | 6.4 | 2024-12-24 | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-block-editor-addons/po… |
CVE-2024-11726 | Medium | 6.5 | 2024-12-24 | The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter o… |
CVE-2024-10856 | Medium | 6.5 | 2024-12-24 | The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in ve… |
CVE-2024-10584 | Medium | 5.4 | 2024-12-24 | The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all… |
CVE-2024-8721 | Medium | 6.4 | 2024-12-24 | The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2… |
CVE-2024-53241 | Medium | 5.5 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen… |
CVE-2024-53240 | Medium | 5.7 | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: xen/netfront: fix crash when removing device When removing a netfront device directly aft… |
CVE-2024-12881 | High | 8.8 | 2024-12-24 | The PlugVersions – Easily rollback to previous versions of your plugins plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capabilit… |
CVE-2024-12850 | Medium | 4.9 | 2024-12-24 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi… |
CVE-2024-12103 | Medium | 5.3 | 2024-12-24 | The Content No Cache: prevent specific content from being cached plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includin… |
CVE-2024-12031 | Medium | 6.5 | 2024-12-24 | The Advanced Floating Content plugin for WordPress is vulnerable to SQL Injection via the 'floating_content_duplicate_post' function in all versions up to, and… |
CVE-2024-12468 | Medium | 6.1 | 2024-12-24 | The WP Datepicker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpdp_get_selected_datepicker' parameter in all versions up to… |
CVE-2024-11896 | Medium | 6.4 | 2024-12-24 | The Text Prompter – Unlimited chatgpt text prompts for openai tasks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'text_pr… |
CVE-2024-12814 | Medium | 6.4 | 2024-12-24 | The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all versions up to, and in… |
CVE-2024-41887 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can create an NVR log file in a directory… | |
CVE-2024-41886 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker could inject malformed data into url input… | |
CVE-2024-41885 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. The seed string for the encrypt key was hardcoding. Th… | |
CVE-2024-41884 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. If an attacker does not enter any value for a specific… | |
CVE-2024-41883 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR . An attacker enters a special value for a specific… | |
CVE-2024-41882 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can cause a stack overflow by entering lar… | |
CVE-2024-12622 | Medium | 6.4 | 2024-12-24 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' and 'wp_cart_display_pro… |
CVE-2024-12594 | High | 8.8 | 2024-12-24 | The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login… |
CVE-2024-12405 | Medium | 6.1 | 2024-12-24 | The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2… |
CVE-2024-12210 | Medium | 4.3 | 2024-12-24 | The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-12100 | Medium | 6.1 | 2024-12-24 | The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr… |
CVE-2024-12096 | Medium | 6.1 | 2024-12-24 | The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12034 | Medium | 5.3 | 2024-12-24 | The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not uti… |
CVE-2024-11885 | Medium | 6.4 | 2024-12-24 | The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtele_button shortcode in all versions up… |
CVE-2024-12710 | Medium | 6.1 | 2024-12-24 | The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to… |
CVE-2024-12617 | Medium | 5.4 | 2024-12-24 | The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all ver… |
CVE-2024-12518 | Medium | 6.4 | 2024-12-24 | The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode in all versions up to, and inclu… |
CVE-2024-12507 | Medium | 6.4 | 2024-12-24 | The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and in… |
CVE-2024-12266 | Medium | 6.5 | 2024-12-24 | The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the e… |
CVE-2024-9427 | Medium | 5.4 | 2024-12-24 | A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web… |
CVE-2024-47515 | High | 8.1 | 2024-12-24 | A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allo… |
CVE-2024-12582 | High | 7.1 | 2024-12-24 | A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a use… |
CVE-2024-53961 | High | 8.1 | 2024-12-23 | ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilit… |
CVE-2024-56363 | High | 7.8 | 2024-12-23 | APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security orga… |
CVE-2024-56362 | High | 7.1 | 2024-12-23 | Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file unde… |
CVE-2024-53276 | | 2024-12-23 | Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow… | |
CVE-2024-53275 | | 2024-12-23 | Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vul… | |
CVE-2024-40896 | Critical | 9.1 | 2024-12-23 | In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers… |
CVE-2024-56364 | Medium | 5.4 | 2024-12-23 | SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx metho… |
CVE-2024-56326 | High | 7.8 | 2024-12-23 | Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker th… |
CVE-2024-56201 | High | 8.8 | 2024-12-23 | Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the c… |
CVE-2024-55947 | High | 8.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. T… |
CVE-2024-54148 | Critical | 9.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the se… |
CVE-2024-53256 | High | 7.8 | 2024-12-23 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due… |
CVE-2024-45387 | Critical | 9.9 | 2024-12-23 | An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-55539 | Low | 2.5 | 2024-12-23 | Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Prote… |
CVE-2024-12903 | High | 7.8 | 2024-12-23 | Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to… |
CVE-2024-12902 | High | 8.4 | 2024-12-23 | ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privil… |
CVE-2024-11230 | Medium | 6.4 | 2024-12-23 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and inc… |
CVE-2024-12901 | Medium | 5.3 | 2024-12-23 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controlle… |
CVE-2024-12900 | Medium | 6.3 | 2024-12-23 | A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component… |
CVE-2024-54082 | High | 7.2 | 2024-12-23 | home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be execu… |
CVE-2024-52321 | Medium | 5.9 | 2024-12-23 | Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive i… |
CVE-2024-47864 | Medium | 5.3 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated att… |
CVE-2024-46873 | Critical | 9.8 | 2024-12-23 | Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated att… |
CVE-2024-45721 | High | 7.2 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary… |
CVE-2024-12899 | High | 7.3 | 2024-12-23 | A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2024-12898 | Medium | 6.3 | 2024-12-23 | A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-56378 | Medium | 4.3 | 2024-12-23 | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. |
CVE-2024-12897 | Medium | 4.3 | 2024-12-23 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affec… |
CVE-2024-56375 | High | 7.5 | 2024-12-22 | An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (vi… |
CVE-2024-12896 | Medium | 5.3 | 2024-12-22 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this… |
CVE-2024-56314 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the… |
CVE-2024-56313 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into… |
CVE-2024-56312 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts… |
CVE-2024-56311 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker ca… |
CVE-2024-56310 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit… |
CVE-2024-12895 | Medium | 6.3 | 2024-12-22 | A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function consol… |
CVE-2024-12894 | Medium | 6.3 | 2024-12-22 | A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file Treasu… |
CVE-2024-12893 | Low | 2.4 | 2024-12-22 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of… |
CVE-2024-12892 | Low | 3.5 | 2024-12-22 | A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2024-12891 | Medium | 6.3 | 2024-12-22 | A vulnerability classified as critical has been found in code-projects Online Exam Mastering System 1.0. Affected is an unknown function of the file /account.p… |
CVE-2024-12890 | Medium | 6.3 | 2024-12-22 | A vulnerability was found in code-projects Online Exam Mastering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-11852 | Medium | 4.3 | 2024-12-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorize… |