2024 CVEs (page 67)
Page 67 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28767 | Medium | 6.8 | 2024-12-20 | IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on… |
CVE-2024-12014 | | 2024-12-20 | Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access a… | |
CVE-2024-7726 | Medium | 6.8 | 2024-12-20 | There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that… |
CVE-2024-9619 | Medium | 6.4 | 2024-12-20 | The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insuffi… |
CVE-2024-9503 | Medium | 4.3 | 2024-12-20 | The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-12571 | Critical | 9.8 | 2024-12-20 | The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engin… |
CVE-2024-12509 | Medium | 6.4 | 2024-12-20 | The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_twine' shortcode in all versions up to, and including… |
CVE-2024-12506 | Medium | 6.4 | 2024-12-20 | The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and includ… |
CVE-2024-11893 | Medium | 6.4 | 2024-12-20 | The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spoki_button' shortc… |
CVE-2024-11878 | Medium | 6.4 | 2024-12-20 | The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up… |
CVE-2024-11812 | Medium | 6.1 | 2024-12-20 | The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to miss… |
CVE-2024-11806 | Medium | 6.1 | 2024-12-20 | The PKT1 Centro de envios plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' and 'error' parameters in all versions up to… |
CVE-2024-11784 | Medium | 6.4 | 2024-12-20 | The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop… |
CVE-2024-11783 | Medium | 6.4 | 2024-12-20 | The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'finance_calculator' shortcode in all versions up t… |
CVE-2024-11775 | Medium | 6.4 | 2024-12-20 | The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, an… |
CVE-2024-11774 | Medium | 6.4 | 2024-12-20 | The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and inclu… |
CVE-2024-11411 | Medium | 6.4 | 2024-12-20 | The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including… |
CVE-2024-11331 | Medium | 6.1 | 2024-12-20 | The استخراج محصولات ووکامرس برای آیسی plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg w… |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2024-8968 | Medium | 4.7 | 2024-12-20 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-5955 | Medium | 5.4 | 2024-12-20 | Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft re… |
CVE-2024-11108 | Medium | 5.4 | 2024-12-20 | The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2024-10706 | Medium | 4.8 | 2024-12-20 | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10555 | Medium | 4.8 | 2024-12-20 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-21549 | High | 8.6 | 2024-12-20 | Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An att… |
CVE-2024-44298 | Low | 3.3 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access inf… |
CVE-2024-44293 | Medium | 5.5 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. A user may be able to view sensi… |
CVE-2024-44292 | Medium | 5.5 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sen… |
CVE-2024-44231 | Medium | 4.6 | 2024-12-20 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. A person with physical access to a Mac may be able to by… |
CVE-2024-44223 | Medium | 4.6 | 2024-12-20 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to a Mac may be able to… |
CVE-2024-44211 | Medium | 5.5 | 2024-12-20 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2024-44195 | High | 7.5 | 2024-12-20 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files. |
CVE-2024-11776 | Medium | 6.4 | 2024-12-20 | The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, an… |
CVE-2024-12678 | Medium | 6.5 | 2024-12-20 | Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity token… |
CVE-2024-54538 | High | 7.5 | 2024-12-20 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Se… |
CVE-2024-12832 | Medium | 6.3 | 2024-12-20 | Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files… |
CVE-2024-12831 | High | 7.8 | 2024-12-20 | Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2024-12830 | High | 7.3 | 2024-12-20 | Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-12829 | High | 8.8 | 2024-12-20 | Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-56327 | Critical | 9.8 | 2024-12-19 | pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `a… |
CVE-2024-54663 | High | 7.5 | 2024-12-19 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the… |
CVE-2024-54009 | Medium | 4.0 | 2024-12-19 | Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited to allow disclosure… |
CVE-2024-12700 | High | 8.8 | 2024-12-19 | There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell and execute code with… |
CVE-2024-54984 | Critical | 9.8 | 2024-12-19 | An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier. |
CVE-2024-54983 | Critical | 9.8 | 2024-12-19 | An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message. |
CVE-2024-54982 | | 2024-12-19 | An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. NOTE: Quectel disputes this be… | |
CVE-2024-2201 | Medium | 4.7 | 2024-12-19 | A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux ker… |
CVE-2024-12729 | High | 8.8 | 2024-12-19 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1… |
CVE-2024-12728 | Critical | 9.8 | 2024-12-19 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). |
CVE-2024-12727 | Critical | 9.8 | 2024-12-19 | A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting… |
CVE-2024-12672 | High | 7.3 | 2024-12-19 | A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DO… |
CVE-2024-12175 | High | 7.8 | 2024-12-19 | Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force th… |
CVE-2024-11364 | High | 7.3 | 2024-12-19 | Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and… |
CVE-2024-11157 | High | 7.3 | 2024-12-19 | A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DO… |
CVE-2024-7139 | Medium | 6.5 | 2024-12-19 | Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a te… |
CVE-2024-7138 | Medium | 6.5 | 2024-12-19 | An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is n… |
CVE-2024-7137 | Medium | 6.5 | 2024-12-19 | The L2CAP receive data buffer for L2CAP packets is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceeds t… |
CVE-2024-53991 | High | 7.5 | 2024-12-19 | Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` wh… |
CVE-2024-52794 | Medium | 6.8 | 2024-12-19 | Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the late… |
CVE-2024-52589 | Low | 2.2 | 2024-12-19 | Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn t… |
CVE-2024-49765 | Medium | 5.3 | 2024-12-19 | Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers… |
CVE-2024-12111 | High | 8.0 | 2024-12-19 | In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication… |
CVE-2024-56200 | High | 8.6 | 2024-12-19 | Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote… |
CVE-2024-56159 | Medium | 5.3 | 2024-12-19 | Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. Durin… |
CVE-2024-55196 | High | 7.5 | 2024-12-19 | Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IM… |
CVE-2024-54150 | Critical | 9.1 | 2024-12-19 | cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to… |
CVE-2024-52897 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2024-51471 | Medium | 5.3 | 2024-12-19 | IBM MQ Appliance 9.3 LTS, 9.3 CD, and 9.4 LTS web console could allow an authenticated user to cause a denial-of-service when trace is enabled due to informati… |
CVE-2024-49336 | Medium | 6.5 | 2024-12-19 | IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests… |
CVE-2024-38819 | High | 7.5 | 2024-12-19 | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can c… |
CVE-2024-12794 | Medium | 6.3 | 2024-12-19 | A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admin/editorder.php. Th… |
CVE-2024-12793 | Medium | 4.3 | 2024-12-19 | A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file… |
CVE-2024-12792 | High | 7.3 | 2024-12-19 | A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadm… |
CVE-2024-12791 | High | 7.3 | 2024-12-19 | A vulnerability was found in Codezips E-Commerce Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file signin.php. Th… |
CVE-2024-55081 | Critical | 9.8 | 2024-12-19 | An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplyi… |
CVE-2024-52896 | Medium | 6.2 | 2024-12-19 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2024-12801 | | 2024-12-19 | Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to… | |
CVE-2024-12790 | Low | 3.5 | 2024-12-19 | A vulnerability was found in code-projects Hostel Management Site 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-12789 | Medium | 6.3 | 2024-12-19 | A vulnerability was found in PbootCMS up to 3.2.3. It has been classified as critical. This affects an unknown part of the file apps/home/controller/IndexContr… |
CVE-2024-12788 | High | 7.3 | 2024-12-19 | A vulnerability was found in Codezips Technical Discussion Forum 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-9154 | | 2024-12-19 | A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: throu… | |
CVE-2024-55082 | High | 7.5 | 2024-12-19 | A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensitive information vi… |
CVE-2024-38864 | Low | 3.3 | 2024-12-19 | Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p23, < 2.2.0p38 and <= 2.1.0p49 (EOL) allows a local attacker to read sen… |
CVE-2024-12798 | | 2024-12-19 | ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows … | |
CVE-2024-12787 | High | 7.3 | 2024-12-19 | A vulnerability has been found in 1000 Projects Attendance Tracking Management System 1.0 and classified as critical. Affected by this vulnerability is an unkn… |
CVE-2024-54790 | High | 7.5 | 2024-12-19 | A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execute arbitrary code… |
CVE-2024-47093 | High | 8.8 | 2024-12-19 | Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS |
CVE-2024-25131 | High | 8.8 | 2024-12-19 | A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a… |
CVE-2024-12786 | High | 7.8 | 2024-12-19 | A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnectio… |
CVE-2024-12785 | Medium | 6.3 | 2024-12-19 | A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-9102 | | 2024-12-19 | phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Val… | |
CVE-2024-9101 | | 2024-12-19 | A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attacker… | |
CVE-2024-12784 | Medium | 6.3 | 2024-12-19 | A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbi… |
CVE-2024-10244 | Critical | 9.8 | 2024-12-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection. This is… |
CVE-2024-12783 | Low | 3.5 | 2024-12-19 | A vulnerability was found in itsourcecode Vehicle Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /… |
CVE-2024-12782 | High | 7.3 | 2024-12-19 | A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerab… |
CVE-2024-45819 | Medium | 5.5 | 2024-12-19 | PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into gues… |
CVE-2024-45818 | Medium | 6.5 | 2024-12-19 | The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unu… |
CVE-2024-37962 | Medium | 6.5 | 2024-12-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion.This issue affects Fus… |
CVE-2024-12626 | Critical | 9.6 | 2024-12-19 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-S… |