2024 CVEs (page 8)
Page 8 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13975 | | 2025-07-25 | A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations… | |
CVE-2024-48730 | Medium | 6.5 | 2025-07-25 | The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts perform… |
CVE-2024-48729 | High | 7.1 | 2025-07-25 | An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privi… |
CVE-2024-41751 | Medium | 5.5 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-s… |
CVE-2024-41750 | Medium | 5.5 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-s… |
CVE-2024-40686 | Medium | 5.4 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper val… |
CVE-2024-40682 | Medium | 6.2 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to i… |
CVE-2024-12310 | | 2025-07-23 | A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and al… | |
CVE-2024-53288 | Medium | 5.9 | 2025-07-23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM)… |
CVE-2024-53287 | Medium | 5.9 | 2025-07-23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM… |
CVE-2024-53286 | High | 7.2 | 2025-07-23 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manage… |
CVE-2024-38335 | Medium | 4.5 | 2025-07-22 | IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resou… |
CVE-2024-55040 | Medium | 6.1 | 2025-07-21 | Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted… |
CVE-2024-13974 | High | 8.1 | 2025-07-21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’… |
CVE-2024-13973 | Medium | 6.8 | 2025-07-21 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving a… |
CVE-2024-6107 | Critical | 9.6 | 2025-07-21 | Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addr… |
CVE-2024-13175 | Medium | 5.5 | 2025-07-18 | Authorization Bypass Through User-Controlled Key vulnerability in Vidco Software VOC TESTER allows Forceful Browsing. This issue affects VOC TESTER: before 12… |
CVE-2024-32124 | Medium | 4.3 | 2025-07-18 | An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authent… |
CVE-2024-27779 | Medium | 6.7 | 2025-07-18 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2… |
CVE-2024-42209 | Low | 3.5 | 2025-07-17 | HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, whic… |
CVE-2024-41921 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemy… |
CVE-2024-41148 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemy… |
CVE-2024-39835 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjem… |
CVE-2024-39289 | High | 7.8 | 2025-07-17 | A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier… |
CVE-2024-13972 | High | 8.8 | 2025-07-17 | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SY… |
CVE-2024-32323 | High | 8.1 | 2025-07-17 | SQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain sensitive information via the if parameter in hcit.project.rte… |
CVE-2024-42912 | Medium | 5.4 | 2025-07-16 | A cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows attackers to execute arbitrary web scripts o… |
CVE-2024-9408 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. |
CVE-2024-9343 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-9342 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts… |
CVE-2024-10032 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-10031 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating… |
CVE-2024-10029 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. |
CVE-2024-42650 | High | 7.5 | 2025-07-15 | NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of… |
CVE-2024-42649 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. |
CVE-2024-42648 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message. |
CVE-2024-42646 | High | 7.5 | 2025-07-14 | A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51768 | High | 8.0 | 2025-07-14 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-26293 | | 2025-07-14 | The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated… | |
CVE-2024-26292 | | 2025-07-14 | An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series: before 2025.5.1; A… | |
CVE-2024-26291 | | 2025-07-14 | An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allow… | |
CVE-2024-58258 | High | 7.2 | 2025-07-13 | SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. |
CVE-2024-41169 | High | 7.5 | 2025-07-12 | The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This is… |
CVE-2024-38648 | Medium | 5.7 | 2025-07-12 | A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials. |
CVE-2024-47065 | Medium | 6.5 | 2025-07-11 | Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR… |
CVE-2024-47252 | High | 7.5 | 2025-07-10 | Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters… |
CVE-2024-43394 | High | 7.5 | 2025-07-10 | Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache exp… |
CVE-2024-43204 | High | 7.5 | 2025-07-10 | SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely… |
CVE-2024-42516 | High | 7.5 | 2025-07-10 | HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or pro… |
CVE-2024-39752 | Medium | 6.8 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. A… |
CVE-2024-38327 | Medium | 6.8 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could… |
CVE-2024-37524 | Medium | 5.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2024-36697 | Medium | 6.1 | 2025-07-10 | A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-7650 | | 2025-07-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could a… | |
CVE-2024-56468 | High | 7.5 | 2025-07-08 | IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 could allow a remote user to cause a denial of service by sending an invalid HTTP request to t… |
CVE-2024-49784 | Medium | 5.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authen… |
CVE-2024-49783 | Medium | 5.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with ac… |
CVE-2024-36357 | Medium | 5.6 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensit… |
CVE-2024-36350 | Medium | 5.6 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of pr… |
CVE-2024-36349 | Low | 3.8 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting i… |
CVE-2024-36348 | Low | 3.8 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enable… |
CVE-2024-55599 | Medium | 5.3 | 2025-07-08 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all vers… |
CVE-2024-52965 | High | 7.2 | 2025-07-08 | A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, a… |
CVE-2024-53009 | Medium | 5.3 | 2025-07-08 | Memory corruption while operating the mailbox in Automotive. |
CVE-2024-31854 | High | 8.1 | 2025-07-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed devi… |
CVE-2024-31853 | High | 8.1 | 2025-07-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed devi… |
CVE-2024-43190 | Medium | 5.9 | 2025-07-07 | IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a l… |
CVE-2024-37658 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php. |
CVE-2024-37657 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component. |
CVE-2024-37656 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification i… |
CVE-2024-25178 | Critical | 9.1 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. |
CVE-2024-25177 | High | 7.5 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). |
CVE-2024-25176 | Critical | 9.8 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. |
CVE-2024-43334 | High | 7.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affect… |
CVE-2024-58117 | Medium | 4.0 | 2025-07-07 | Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview functio… |
CVE-2024-9453 | Medium | 6.5 | 2025-07-04 | A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are ce… |
CVE-2024-11937 | Medium | 6.4 | 2025-07-04 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all v… |
CVE-2024-5647 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versio… |
CVE-2024-9017 | Medium | 6.4 | 2025-07-03 | The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including… |
CVE-2024-35164 | Medium | 6.8 | 2025-07-02 | The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If… |
CVE-2024-13786 | Critical | 9.8 | 2025-07-02 | The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in… |
CVE-2024-13451 | Medium | 5.3 | 2025-07-02 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-11405 | Medium | 6.1 | 2025-07-02 | The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters… |
CVE-2024-49365 | | 2025-07-01 | tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when glob… | |
CVE-2024-49364 | | 2025-07-01 | tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object… | |
CVE-2024-46993 | | 2025-07-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 3… | |
CVE-2024-46992 | High | 7.8 | 2025-07-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30… |
CVE-2024-12915 | Medium | 4.6 | 2025-06-30 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected… |
CVE-2024-53621 | High | 7.5 | 2025-06-30 | A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Servic… |
CVE-2024-8419 | High | 7.5 | 2025-06-30 | The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication. |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2024-52900 | Medium | 6.4 | 2025-06-28 | IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authent… |
CVE-2024-39730 | Medium | 5.4 | 2025-06-28 | IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2024-36347 | Medium | 6.4 | 2025-06-27 | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, pot… |
CVE-2024-12364 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL In… |
CVE-2024-12150 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This… |
CVE-2024-12143 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB… |