2024 CVEs (page 7)
Page 7 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58259 | High | 8.2 | 2025-09-02 | A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authe… |
CVE-2024-52284 | High | 7.7 | 2025-09-02 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing cred… |
CVE-2024-12973 | Medium | 4.7 | 2025-09-02 | Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from… |
CVE-2024-12972 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross-Site Scripting (XS… |
CVE-2024-28988 | Critical | 9.8 | 2025-09-01 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2024-12925 | High | 7.3 | 2025-09-01 | Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP Response Splitting. This issue affects QR Menü: from s1.05… |
CVE-2024-12924 | Medium | 6.3 | 2025-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akınsoft QR Menü allows Forceful Browsing, Phishing. This issue affects QR Menü: from s1… |
CVE-2024-12914 | Medium | 4.3 | 2025-09-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akınsoft QR Menü allows Cross-Site Scripting (XSS)… |
CVE-2024-32832 | Critical | 9.8 | 2025-08-31 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-32589 | High | 7.1 | 2025-08-31 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-prod… |
CVE-2024-46484 | Critical | 9.8 | 2025-08-29 | TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. |
CVE-2024-12923 | Medium | 5.4 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2024-46917 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validation. This allows c… |
CVE-2024-46916 | High | 8.1 | 2025-08-29 | Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is prop… |
CVE-2024-13342 | High | 8.1 | 2025-08-29 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' functi… |
CVE-2024-13987 | Medium | 5.9 | 2025-08-29 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users… |
CVE-2024-54568 | Medium | 4.3 | 2025-08-29 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. Parsing a maliciously crafted file may lead to an unexpected… |
CVE-2024-54554 | Medium | 5.5 | 2025-08-29 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
CVE-2024-44271 | Low | 3.3 | 2025-08-29 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to record the screen without an indicator. |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2024-48908 | | 2025-08-28 | lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code… | |
CVE-2024-49790 | Medium | 5.4 | 2025-08-28 | IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary J… |
CVE-2024-58240 | Critical | 9.8 | 2025-08-28 | In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, t… |
CVE-2024-13807 | High | 7.5 | 2025-08-28 | The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality d… |
CVE-2024-9648 | Medium | 6.1 | 2025-08-28 | The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class… |
CVE-2024-13985 | | 2025-08-27 | A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the… | |
CVE-2024-13984 | | 2025-08-27 | QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthent… | |
CVE-2024-13982 | | 2025-08-27 | SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the… | |
CVE-2024-13981 | | 2025-08-27 | LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its… | |
CVE-2024-13980 | | 2025-08-27 | H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoi… | |
CVE-2024-13979 | Critical | 9.8 | 2025-08-27 | A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via c… |
CVE-2024-37777 | High | 8.8 | 2025-08-27 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |
CVE-2024-49740 | Medium | 5.5 | 2025-08-26 | In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privi… |
CVE-2024-47192 | Medium | 5.3 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have… |
CVE-2024-35203 | Medium | 6.1 | 2025-08-26 | Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Ma… |
CVE-2024-39335 | Critical | 9.1 | 2025-08-26 | Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under… |
CVE-2024-47853 | High | 8.8 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning T… |
CVE-2024-45753 | Medium | 6.1 | 2025-08-26 | In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute. |
CVE-2024-8860 | Medium | 4.3 | 2025-08-26 | The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_funct… |
CVE-2024-46413 | Medium | 5.1 | 2025-08-25 | Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loa… |
CVE-2024-46412 | Medium | 6.5 | 2025-08-25 | Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-lo… |
CVE-2024-39923 | Medium | 6.1 | 2025-08-25 | An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cr… |
CVE-2024-48988 | High | 7.6 | 2025-08-22 | SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version… |
CVE-2024-53499 | Critical | 9.8 | 2025-08-22 | Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. |
CVE-2024-53496 | Critical | 9.8 | 2025-08-22 | Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2024-50645 | Critical | 9.8 | 2025-08-22 | MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-53494 | High | 7.5 | 2025-08-22 | Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. |
CVE-2024-50644 | Critical | 9.8 | 2025-08-22 | zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-58239 | High | 8.2 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record… |
CVE-2024-56179 | High | 7.8 | 2025-08-22 | In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via directory traversal if… |
CVE-2024-50641 | High | 8.1 | 2025-08-21 | An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token. |
CVE-2024-45438 | Critical | 9.1 | 2025-08-21 | An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTi… |
CVE-2024-57155 | Critical | 9.8 | 2025-08-20 | Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57154 | Critical | 9.8 | 2025-08-20 | Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index. |
CVE-2024-57152 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen… |
CVE-2024-53495 | High | 7.5 | 2025-08-20 | Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2024-50640 | Critical | 9.8 | 2025-08-20 | jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function |
CVE-2024-57157 | Critical | 9.8 | 2025-08-20 | Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. |
CVE-2024-57491 | High | 8.8 | 2025-08-20 | Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token vi… |
CVE-2024-39954 | Medium | 6.3 | 2025-08-20 | CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functiona… |
CVE-2024-12223 | | 2025-08-20 | Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a vict… | |
CVE-2024-44373 | Critical | 9.8 | 2025-08-19 | A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution v… |
CVE-2024-45062 | Medium | 6.4 | 2025-08-19 | A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buf… |
CVE-2024-49827 | Low | 3.7 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering. |
CVE-2024-8393 | Medium | 6.6 | 2025-08-16 | The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' p… |
CVE-2024-12612 | High | 7.5 | 2025-08-16 | The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX action in all versio… |
CVE-2024-12575 | Medium | 5.3 | 2025-08-16 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and includi… |
CVE-2024-37945 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2024-53946 | High | 8.8 | 2025-08-14 | The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker… |
CVE-2024-53945 | High | 8.8 | 2025-08-14 | The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticat… |
CVE-2024-7402 | | 2025-08-14 | Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by… | |
CVE-2024-5477 | | 2025-08-13 | A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execu… | |
CVE-2024-12303 | Medium | 6.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2024-10219 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2024-52964 | Medium | 5.5 | 2025-08-12 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1… |
CVE-2024-48892 | Medium | 6.8 | 2025-08-12 | A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacke… |
CVE-2024-40588 | Medium | 4.4 | 2025-08-12 | Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versio… |
CVE-2024-26009 | High | 8.1 | 2025-08-12 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, For… |
CVE-2024-33607 | Medium | 5.6 | 2025-08-12 | Out-of-bounds read in some Intel(R) TDX module software before version TDX_1.5.07.00.774 may allow an authenticated user to potentially enable information disc… |
CVE-2024-38805 | Medium | 6.3 | 2025-08-12 | EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerabilit… |
CVE-2024-54678 | High | 8.2 | 2025-08-12 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1… |
CVE-2024-52504 | High | 7.5 | 2025-08-12 | A vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIPROTEC 4 6MD665 (Al… |
CVE-2024-41986 | Medium | 6.4 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41985 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41984 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41983 | Low | 3.5 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41982 | Medium | 4.8 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41980 | Low | 3.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41979 | High | 7.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-32640 | Critical | 9.8 | 2025-08-11 | MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulne… |
CVE-2024-58238 | High | 7.1 | 2025-08-09 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test This fixes the t… |
CVE-2024-58257 | Medium | 5.7 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58256 | Medium | 4.5 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-58255 | Medium | 5.0 | 2025-08-08 | EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. |
CVE-2024-42048 | Medium | 6.5 | 2025-08-07 | OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the in… |
CVE-2024-56339 | Low | 3.7 | 2025-08-07 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restri… |
CVE-2024-55401 | Medium | 6.5 | 2025-08-07 | An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. |
CVE-2024-52680 | Medium | 6.1 | 2025-08-07 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. |
CVE-2024-55402 | Medium | 5.3 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. |