2024 CVEs (page 8)
Page 8 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55399 | Medium | 6.5 | 2025-08-06 | 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). |
CVE-2024-55398 | Medium | 6.5 | 2025-08-06 | 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. |
CVE-2024-8244 | Low | 3.7 | 2025-08-06 | The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/… |
CVE-2024-52885 | Medium | 5.0 | 2025-08-06 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to a… |
CVE-2024-52890 | Medium | 6.1 | 2025-08-05 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs. |
CVE-2024-45183 | Medium | 6.5 | 2025-08-04 | An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound… |
CVE-2024-51775 | Medium | 5.3 | 2025-08-03 | Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restri… |
CVE-2024-52279 | Medium | 5.3 | 2025-08-03 | Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issu… |
CVE-2024-41177 | Medium | 6.1 | 2025-08-03 | Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to up… |
CVE-2024-13978 | Low | 2.5 | 2025-08-01 | A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the… |
CVE-2024-34327 | Medium | 6.5 | 2025-07-31 | Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form. |
CVE-2024-34328 | Medium | 6.3 | 2025-07-31 | An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. |
CVE-2024-48916 | High | 8.1 | 2025-07-30 | Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by… |
CVE-2024-45955 | High | 7.3 | 2025-07-30 | Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter. |
CVE-2024-45515 | Medium | 6.1 | 2025-07-30 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient val… |
CVE-2024-43018 | Medium | 6.4 | 2025-07-29 | Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from… |
CVE-2024-52894 | Medium | 4.9 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-51473 | Medium | 6.5 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-49828 | Medium | 6.5 | 2025-07-29 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 throug… |
CVE-2024-42655 | High | 8.8 | 2025-07-29 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard char… |
CVE-2024-42651 | High | 7.5 | 2025-07-29 | NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a D… |
CVE-2024-42645 | High | 7.5 | 2025-07-29 | An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS). |
CVE-2024-42644 | High | 7.5 | 2025-07-29 | FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publis… |
CVE-2024-49343 | Medium | 5.4 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be ex… |
CVE-2024-49342 | High | 7.5 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2024-58266 | Low | 3.2 | 2025-07-27 | The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. |
CVE-2024-58265 | Low | 3.1 | 2025-07-27 | The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery. |
CVE-2024-58264 | Low | 3.2 | 2025-07-27 | The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. |
CVE-2024-58263 | Low | 3.7 | 2025-07-27 | The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations. |
CVE-2024-58262 | Low | 2.9 | 2025-07-27 | The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM. |
CVE-2024-58261 | Low | 2.9 | 2025-07-27 | The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertPa… |
CVE-2024-13507 | High | 7.5 | 2025-07-26 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist p… |
CVE-2024-13976 | | 2025-07-25 | A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates… | |
CVE-2024-13975 | | 2025-07-25 | A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations… | |
CVE-2024-48730 | Medium | 6.5 | 2025-07-25 | The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts perform… |
CVE-2024-48729 | High | 7.1 | 2025-07-25 | An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privi… |
CVE-2024-41751 | Medium | 5.5 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-s… |
CVE-2024-41750 | Medium | 5.5 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-s… |
CVE-2024-40686 | Medium | 5.4 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper val… |
CVE-2024-40682 | Medium | 6.2 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to i… |
CVE-2024-12310 | | 2025-07-23 | A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and al… | |
CVE-2024-53288 | Medium | 5.9 | 2025-07-23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM)… |
CVE-2024-53287 | Medium | 5.9 | 2025-07-23 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM… |
CVE-2024-53286 | High | 7.2 | 2025-07-23 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manage… |
CVE-2024-38335 | Medium | 4.5 | 2025-07-22 | IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resou… |
CVE-2024-55040 | Medium | 6.1 | 2025-07-21 | Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted… |
CVE-2024-13974 | High | 8.1 | 2025-07-21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’… |
CVE-2024-13973 | Medium | 6.8 | 2025-07-21 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving a… |
CVE-2024-6107 | Critical | 9.6 | 2025-07-21 | Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addr… |
CVE-2024-13175 | Medium | 5.5 | 2025-07-18 | Authorization Bypass Through User-Controlled Key vulnerability in Vidco Software VOC TESTER allows Forceful Browsing. This issue affects VOC TESTER: before 12… |
CVE-2024-32124 | Medium | 4.3 | 2025-07-18 | An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authent… |
CVE-2024-27779 | Medium | 6.7 | 2025-07-18 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2… |
CVE-2024-42209 | Low | 3.5 | 2025-07-17 | HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, whic… |
CVE-2024-41921 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemy… |
CVE-2024-41148 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemy… |
CVE-2024-39835 | High | 7.8 | 2025-07-17 | A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjem… |
CVE-2024-39289 | High | 7.8 | 2025-07-17 | A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier… |
CVE-2024-13972 | High | 8.8 | 2025-07-17 | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SY… |
CVE-2024-32323 | High | 8.1 | 2025-07-17 | SQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain sensitive information via the if parameter in hcit.project.rte… |
CVE-2024-42912 | Medium | 5.4 | 2025-07-16 | A cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows attackers to execute arbitrary web scripts o… |
CVE-2024-9408 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. |
CVE-2024-9343 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-9342 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts… |
CVE-2024-10032 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-10031 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating… |
CVE-2024-10029 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. |
CVE-2024-42650 | High | 7.5 | 2025-07-15 | NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of… |
CVE-2024-42649 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. |
CVE-2024-42648 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message. |
CVE-2024-42646 | High | 7.5 | 2025-07-14 | A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51768 | High | 8.0 | 2025-07-14 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-26293 | | 2025-07-14 | The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated… | |
CVE-2024-26292 | | 2025-07-14 | An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series: before 2025.5.1; A… | |
CVE-2024-26291 | | 2025-07-14 | An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allow… | |
CVE-2024-58258 | High | 7.2 | 2025-07-13 | SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. |
CVE-2024-41169 | High | 7.5 | 2025-07-12 | The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This is… |
CVE-2024-38648 | Medium | 5.7 | 2025-07-12 | A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials. |
CVE-2024-47065 | Medium | 6.5 | 2025-07-11 | Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR… |
CVE-2024-47252 | High | 7.5 | 2025-07-10 | Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters… |
CVE-2024-43394 | High | 7.5 | 2025-07-10 | Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via mod_rewrite or apache exp… |
CVE-2024-43204 | High | 7.5 | 2025-07-10 | SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely… |
CVE-2024-42516 | High | 7.5 | 2025-07-10 | HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or pro… |
CVE-2024-39752 | Medium | 6.8 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. A… |
CVE-2024-38327 | Medium | 6.8 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could… |
CVE-2024-37524 | Medium | 5.3 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2024-36697 | Medium | 6.1 | 2025-07-10 | A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-7650 | | 2025-07-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could a… | |
CVE-2024-56468 | High | 7.5 | 2025-07-08 | IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 could allow a remote user to cause a denial of service by sending an invalid HTTP request to t… |
CVE-2024-49784 | Medium | 5.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authen… |
CVE-2024-49783 | Medium | 5.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with ac… |
CVE-2024-36357 | Medium | 5.6 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensit… |
CVE-2024-36350 | Medium | 5.6 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of pr… |
CVE-2024-36349 | Low | 3.8 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting i… |
CVE-2024-36348 | Low | 3.8 | 2025-07-08 | A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enable… |
CVE-2024-55599 | Medium | 5.3 | 2025-07-08 | An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all vers… |
CVE-2024-52965 | High | 7.2 | 2025-07-08 | A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, a… |
CVE-2024-53009 | Medium | 5.3 | 2025-07-08 | Memory corruption while operating the mailbox in Automotive. |