2024 CVEs (page 80)
Page 80 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46341 | High | 8.0 | 2024-12-10 | TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-th… |
CVE-2024-46340 | Critical | 9.8 | 2024-12-10 | TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing… |
CVE-2024-9844 | High | 7.1 | 2024-12-10 | Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypa… |
CVE-2024-8540 | High | 8.8 | 2024-12-10 | Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application componen… |
CVE-2024-7572 | High | 7.1 | 2024-12-10 | Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. |
CVE-2024-55550 | Low | 2.7 | 2024-12-10 | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sani… |
CVE-2024-55500 | High | 8.8 | 2024-12-10 | Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrar… |
CVE-2024-54008 | High | 7.2 | 2024-12-10 | An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authen… |
CVE-2024-50931 | Medium | 4.6 | 2024-12-10 | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. |
CVE-2024-50930 | High | 8.8 | 2024-12-10 | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. |
CVE-2024-50929 | Medium | 6.2 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memor… |
CVE-2024-50928 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memo… |
CVE-2024-50924 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the… |
CVE-2024-50921 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending craft… |
CVE-2024-50920 | High | 8.8 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. |
CVE-2024-50699 | High | 8.0 | 2024-12-10 | TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator… |
CVE-2024-46442 | Critical | 9.8 | 2024-12-10 | An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. |
CVE-2024-11773 | Critical | 9.1 | 2024-12-10 | SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL sta… |
CVE-2024-11772 | Critical | 9.1 | 2024-12-10 | Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote co… |
CVE-2024-11639 | Critical | 10.0 | 2024-12-10 | An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access |
CVE-2024-11634 | Critical | 9.1 | 2024-12-10 | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with… |
CVE-2024-11633 | Critical | 9.1 | 2024-12-10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code executi… |
CVE-2024-10256 | High | 7.1 | 2024-12-10 | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. |
CVE-2024-53866 | Critical | 9.8 | 2024-12-10 | The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in gl… |
CVE-2024-53247 | High | 8.8 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a… |
CVE-2024-53246 | Medium | 5.3 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206… |
CVE-2024-53245 | Low | 3.1 | 2024-12-10 | In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the… |
CVE-2024-53244 | Medium | 5.7 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privil… |
CVE-2024-53243 | Medium | 4.3 | 2024-12-10 | In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Plat… |
CVE-2024-12286 | Critical | 9.8 | 2024-12-10 | MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials. |
CVE-2024-55602 | High | 7.6 | 2024-12-10 | PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and downlo… |
CVE-2024-55548 | High | 7.5 | 2024-12-10 | Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-420: through 2.01e. |
CVE-2024-55547 | Critical | 9.8 | 2024-12-10 | SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e. |
CVE-2024-55546 | Medium | 5.4 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. |
CVE-2024-55545 | Medium | 6.1 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. |
CVE-2024-46657 | Medium | 5.5 | 2024-12-10 | Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cau… |
CVE-2024-45494 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used shared administrative u… |
CVE-2024-45493 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed t… |
CVE-2024-55544 | High | 8.8 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and be… |
CVE-2024-54152 | | 2024-12-10 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious exp… | |
CVE-2024-10496 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execut… |
CVE-2024-10495 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary… |
CVE-2024-10494 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Suc… |
CVE-2024-54751 | Critical | 9.8 | 2024-12-10 | COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-12323 | Medium | 6.1 | 2024-12-10 | The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 4.6 due to in… |
CVE-2024-12236 | Medium | 5.5 | 2024-12-10 | A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible… |
CVE-2024-5660 | Critical | 9.8 | 2024-12-10 | Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cor… |
CVE-2024-55586 | Critical | 9.8 | 2024-12-10 | Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the ve… |
CVE-2024-54095 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 10). The affected application is vulnerable to integer underflow vulnera… |
CVE-2024-54094 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow… |
CVE-2024-54093 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow… |
CVE-2024-54091 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 12), Solid Edge SE2025 (All versions < V225.0 Update 3). The affected ap… |
CVE-2024-54005 | Medium | 5.1 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-53832 | Medium | 4.6 | 2024-12-10 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is… |
CVE-2024-53242 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-53041 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52051 | High | 7.3 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V1… |
CVE-2024-49849 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI… |
CVE-2024-49704 | Medium | 5.5 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-47117 | Medium | 5.4 | 2024-12-10 | IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2024-11868 | Medium | 5.3 | 2024-12-10 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via cl… |
CVE-2024-52538 | High | 7.6 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-47977 | High | 7.1 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-47484 | High | 8.2 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-11928 | Medium | 6.4 | 2024-12-10 | The iChart – Easy Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and incl… |
CVE-2024-11106 | Medium | 5.3 | 2024-12-10 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core sea… |
CVE-2024-10959 | High | 7.3 | 2024-12-10 | The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_g… |
CVE-2024-11973 | Medium | 6.1 | 2024-12-10 | The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all version… |
CVE-2024-11945 | Medium | 6.4 | 2024-12-10 | The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due to… |
CVE-2024-8256 | | 2024-12-10 | In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect… | |
CVE-2024-45709 | Medium | 5.3 | 2024-12-10 | SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to… |
CVE-2024-11940 | Medium | 6.4 | 2024-12-10 | The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘price’ parameter in all versions up to, and in… |
CVE-2024-47946 | High | 7.2 | 2024-12-10 | If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content… |
CVE-2024-28138 | High | 7.3 | 2024-12-10 | An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the ww… |
CVE-2024-11107 | Medium | 6.1 | 2024-12-10 | The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenti… |
CVE-2024-10708 | Medium | 4.9 | 2024-12-10 | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perfor… |
CVE-2024-21542 | High | 8.6 | 2024-12-10 | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path valid… |
CVE-2024-11205 | High | 8.5 | 2024-12-10 | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function i… |
CVE-2024-37144 | High | 8.2 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-37143 | Critical | 10.0 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-53919 | High | 7.6 | 2024-12-10 | An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically prox… |
CVE-2024-53552 | Critical | 9.8 | 2024-12-10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. |
CVE-2024-54198 | High | 8.5 | 2024-12-10 | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted desti… |
CVE-2024-54197 | High | 7.2 | 2024-12-10 | SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially craft… |
CVE-2024-47585 | Medium | 4.3 | 2024-12-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting i… |
CVE-2024-47582 | Medium | 5.3 | 2024-12-10 | Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This… |
CVE-2024-47581 | Medium | 4.3 | 2024-12-10 | SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileg… |
CVE-2024-47580 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an inter… |
CVE-2024-47579 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the uploa… |
CVE-2024-47578 | Critical | 9.1 | 2024-12-10 | Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to targ… |
CVE-2024-47577 | Low | 2.7 | 2024-12-10 | Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for… |
CVE-2024-47576 | Low | 3.3 | 2024-12-10 | SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the co… |
CVE-2024-32732 | Medium | 5.3 | 2024-12-10 | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This h… |
CVE-2024-9672 | Medium | 5.4 | 2024-12-10 | A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the b… |
CVE-2024-55638 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before… |
CVE-2024-55637 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55636 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55635 | Medium | 6.1 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |
CVE-2024-55634 | High | 8.1 | 2024-12-10 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 be… |
CVE-2024-12393 | Medium | 5.4 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |