2024 CVEs (page 7)
Page 7 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35203 | Medium | 6.1 | 2025-08-26 | Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Ma… |
CVE-2024-39335 | Critical | 9.1 | 2025-08-26 | Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under… |
CVE-2024-47853 | High | 8.8 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning T… |
CVE-2024-45753 | Medium | 6.1 | 2025-08-26 | In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute. |
CVE-2024-8860 | Medium | 4.3 | 2025-08-26 | The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_funct… |
CVE-2024-46413 | Medium | 5.1 | 2025-08-25 | Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loa… |
CVE-2024-46412 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-lo… |
CVE-2024-39923 | Medium | 6.1 | 2025-08-25 | An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cr… |
CVE-2024-48988 | High | 7.6 | 2025-08-22 | SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version… |
CVE-2024-53499 | Critical | 9.8 | 2025-08-22 | Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. |
CVE-2024-53496 | Critical | 9.8 | 2025-08-22 | Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2024-50645 | Critical | 9.8 | 2025-08-22 | MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-53494 | High | 7.5 | 2025-08-22 | Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. |
CVE-2024-50644 | Critical | 9.8 | 2025-08-22 | zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-58239 | High | 8.2 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record… |
CVE-2024-56179 | High | 7.8 | 2025-08-22 | In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via directory traversal if… |
CVE-2024-50641 | High | 8.1 | 2025-08-21 | An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-45438 | Critical | 9.1 | 2025-08-21 | An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTi… |
CVE-2024-57155 | Critical | 9.8 | 2025-08-20 | Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57154 | Critical | 9.8 | 2025-08-20 | Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index. |
CVE-2024-57152 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen… |
CVE-2024-53495 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2024-50640 | Critical | 9.8 | 2025-08-20 | jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function |
CVE-2024-57157 | Critical | 9.8 | 2025-08-20 | Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57491 | High | 8.8 | 2025-08-20 | Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token vi… |
CVE-2024-39954 | Medium | 6.3 | 2025-08-20 | CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functiona… |
CVE-2024-12223 | | 2025-08-20 | Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a vict… | |
CVE-2024-44373 | Critical | 9.8 | 2025-08-19 | A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution v… |
CVE-2024-45062 | Medium | 6.4 | 2025-08-19 | A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buf… |
CVE-2024-49827 | Low | 3.7 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering. |
CVE-2024-8393 | Medium | 6.6 | 2025-08-16 | The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' p… |
CVE-2024-12612 | High | 7.5 | 2025-08-16 | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX action in all versio… |
CVE-2024-12575 | Medium | 5.3 | 2025-08-16 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and includi… |
CVE-2024-37945 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2024-53946 | High | 8.8 | 2025-08-14 | The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker… |
CVE-2024-53945 | High | 8.8 | 2025-08-14 | The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticat… |
CVE-2024-7402 | | 2025-08-14 | Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by… | |
CVE-2024-5477 | | 2025-08-13 | A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execu… | |
CVE-2024-12303 | Medium | 6.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2024-10219 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2024-52964 | Medium | 5.5 | 2025-08-12 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1… |
CVE-2024-48892 | Medium | 6.8 | 2025-08-12 | A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacke… |
CVE-2024-40588 | Medium | 4.4 | 2025-08-12 | Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versio… |
CVE-2024-26009 | High | 8.1 | 2025-08-12 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, For… |
CVE-2024-33607 | Medium | 5.6 | 2025-08-12 | Out-of-bounds read in some Intel(R) TDX module software before version TDX_1.5.07.00.774 may allow an authenticated user to potentially enable information disc… |
CVE-2024-38805 | Medium | 6.3 | 2025-08-12 | EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerabilit… |
CVE-2024-54678 | High | 8.2 | 2025-08-12 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1… |
CVE-2024-52504 | High | 7.5 | 2025-08-12 | A vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIPROTEC 4 6MD665 (Al… |
CVE-2024-41986 | Medium | 6.4 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41985 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41984 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41983 | Low | 3.5 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41982 | Medium | 4.8 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41980 | Low | 3.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41979 | High | 7.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-32640 | Critical | 9.8 | 2025-08-11 | MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulne… |
CVE-2024-58238 | High | 7.1 | 2025-08-09 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test This fixes the t… |
CVE-2024-58257 | Medium | 5.7 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58256 | Medium | 4.5 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58255 | Medium | 5.0 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-42048 | Medium | 6.5 | 2025-08-07 | OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the in… |
CVE-2024-56339 | Low | 3.7 | 2025-08-07 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restri… |
CVE-2024-55401 | Medium | 6.5 | 2025-08-07 | An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. |
CVE-2024-52680 | Medium | 6.1 | 2025-08-07 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. |
CVE-2024-55402 | Medium | 5.3 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. |
CVE-2024-55399 | Medium | 6.5 | 2025-08-06 | 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). |
CVE-2024-55398 | Medium | 6.5 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. |
CVE-2024-8244 | Low | 3.7 | 2025-08-06 | The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/… |
CVE-2024-52885 | Medium | 5.0 | 2025-08-06 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to a… |
CVE-2024-52890 | Medium | 6.1 | 2025-08-05 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs. |
CVE-2024-45183 | Medium | 6.5 | 2025-08-04 | An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound… |
CVE-2024-51775 | Medium | 5.3 | 2025-08-03 | Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restri… |
CVE-2024-52279 | Medium | 5.3 | 2025-08-03 | Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issu… |
CVE-2024-41177 | Medium | 6.1 | 2025-08-03 | Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to up… |
CVE-2024-13978 | Low | 2.5 | 2025-08-01 | A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the… |
CVE-2024-34327 | Medium | 6.5 | 2025-07-31 | Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form. |
CVE-2024-34328 | Medium | 6.3 | 2025-07-31 | An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. |
CVE-2024-48916 | High | 8.1 | 2025-07-30 | Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by… |
CVE-2024-45955 | High | 7.3 | 2025-07-30 | Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter. |
CVE-2024-45515 | Medium | 6.1 | 2025-07-30 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient val… |
CVE-2024-43018 | Medium | 6.4 | 2025-07-29 | Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from… |
CVE-2024-52894 | Medium | 4.9 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-51473 | Medium | 6.5 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-49828 | Medium | 6.5 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-42655 | High | 8.8 | 2025-07-29 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard char… |
CVE-2024-42651 | High | 7.5 | 2025-07-29 | NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a D… |
CVE-2024-42645 | High | 7.5 | 2025-07-29 | An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS). |
CVE-2024-42644 | High | 7.5 | 2025-07-29 | FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publis… |
CVE-2024-49343 | Medium | 5.4 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be ex… |
CVE-2024-49342 | High | 7.5 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2024-58266 | Low | 3.2 | 2025-07-27 | The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. |
CVE-2024-58265 | Low | 3.1 | 2025-07-27 | The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery. |
CVE-2024-58264 | Low | 3.2 | 2025-07-27 | The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. |
CVE-2024-58263 | Low | 3.7 | 2025-07-27 | The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations. |
CVE-2024-58262 | Low | 2.9 | 2025-07-27 | The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM. |
CVE-2024-58261 | Low | 2.9 | 2025-07-27 | The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertPa… |
CVE-2024-13507 | High | 7.5 | 2025-07-26 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist p… |
CVE-2024-13976 | | 2025-07-25 | A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates… | |
CVE-2024-13975 | | 2025-07-25 | A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations… |