2024 CVEs (page 80)
Page 80 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55547 | Critical | 9.8 | 2024-12-10 | SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e. |
CVE-2024-55546 | Medium | 5.4 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. |
CVE-2024-55545 | Medium | 6.1 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. |
CVE-2024-46657 | Medium | 5.5 | 2024-12-10 | Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cau… |
CVE-2024-45494 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used shared administrative u… |
CVE-2024-45493 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed t… |
CVE-2024-55544 | High | 8.8 | 2024-12-10 | Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and be… |
CVE-2024-54152 | | 2024-12-10 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious exp… | |
CVE-2024-10496 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execut… |
CVE-2024-10495 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary… |
CVE-2024-10494 | High | 7.8 | 2024-12-10 | An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Suc… |
CVE-2024-54751 | Critical | 9.8 | 2024-12-10 | COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-12323 | Medium | 6.1 | 2024-12-10 | The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 4.6 due to in… |
CVE-2024-12236 | Medium | 5.5 | 2024-12-10 | A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible… |
CVE-2024-5660 | Critical | 9.8 | 2024-12-10 | Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cor… |
CVE-2024-55586 | Critical | 9.8 | 2024-12-10 | Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the ve… |
CVE-2024-54095 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 10). The affected application is vulnerable to integer underflow vulnera… |
CVE-2024-54094 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow… |
CVE-2024-54093 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow… |
CVE-2024-54091 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 12), Solid Edge SE2025 (All versions < V225.0 Update 3). The affected ap… |
CVE-2024-54005 | Medium | 5.1 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-53832 | Medium | 4.6 | 2024-12-10 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is… |
CVE-2024-53242 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-53041 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52051 | High | 7.3 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V1… |
CVE-2024-49849 | High | 7.8 | 2024-12-10 | A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SI… |
CVE-2024-49704 | Medium | 5.5 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-47117 | Medium | 5.4 | 2024-12-10 | IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2024-11868 | Medium | 5.3 | 2024-12-10 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via cl… |
CVE-2024-52538 | High | 7.6 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-47977 | High | 7.1 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-47484 | High | 8.2 | 2024-12-10 | Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements… |
CVE-2024-11928 | Medium | 6.4 | 2024-12-10 | The iChart – Easy Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and incl… |
CVE-2024-11106 | Medium | 5.3 | 2024-12-10 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core sea… |
CVE-2024-10959 | High | 7.3 | 2024-12-10 | The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_g… |
CVE-2024-11973 | Medium | 6.1 | 2024-12-10 | The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all version… |
CVE-2024-11945 | Medium | 6.4 | 2024-12-10 | The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due to… |
CVE-2024-8256 | | 2024-12-10 | In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect… | |
CVE-2024-45709 | Medium | 5.3 | 2024-12-10 | SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to… |
CVE-2024-11940 | Medium | 6.4 | 2024-12-10 | The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘price’ parameter in all versions up to, and in… |
CVE-2024-47946 | High | 7.2 | 2024-12-10 | If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content… |
CVE-2024-28138 | High | 7.3 | 2024-12-10 | An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the ww… |
CVE-2024-11107 | Medium | 6.1 | 2024-12-10 | The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenti… |
CVE-2024-10708 | Medium | 4.9 | 2024-12-10 | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perfor… |
CVE-2024-21542 | High | 8.6 | 2024-12-10 | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path valid… |
CVE-2024-11205 | High | 8.5 | 2024-12-10 | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function i… |
CVE-2024-37144 | High | 8.2 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-37143 | Critical | 10.0 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-53919 | High | 7.6 | 2024-12-10 | An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically prox… |
CVE-2024-53552 | Critical | 9.8 | 2024-12-10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. |
CVE-2024-54198 | High | 8.5 | 2024-12-10 | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted desti… |
CVE-2024-54197 | High | 7.2 | 2024-12-10 | SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially craft… |
CVE-2024-47585 | Medium | 4.3 | 2024-12-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting i… |
CVE-2024-47582 | Medium | 5.3 | 2024-12-10 | Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This… |
CVE-2024-47581 | Medium | 4.3 | 2024-12-10 | SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileg… |
CVE-2024-47580 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an inter… |
CVE-2024-47579 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the uploa… |
CVE-2024-47578 | Critical | 9.1 | 2024-12-10 | Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to targ… |
CVE-2024-47577 | Low | 2.7 | 2024-12-10 | Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for… |
CVE-2024-47576 | Low | 3.3 | 2024-12-10 | SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the co… |
CVE-2024-32732 | Medium | 5.3 | 2024-12-10 | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This h… |
CVE-2024-9672 | Medium | 5.4 | 2024-12-10 | A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the b… |
CVE-2024-55638 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before… |
CVE-2024-55637 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55636 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55635 | Medium | 6.1 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |
CVE-2024-55634 | High | 8.1 | 2024-12-10 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 be… |
CVE-2024-12393 | Medium | 5.4 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |
CVE-2024-55601 | | 2024-12-09 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed be… | |
CVE-2024-50628 | High | 8.8 | 2024-12-09 | An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized mani… |
CVE-2024-50627 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on… |
CVE-2024-50626 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area n… |
CVE-2024-50625 | High | 8.0 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file pat… |
CVE-2024-12174 | Low | 2.7 | 2024-12-09 | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages s… |
CVE-2024-54151 | High | 7.5 | 2024-12-09 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKE… |
CVE-2024-54149 | High | 8.4 | 2024-12-09 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow… |
CVE-2024-46455 | Critical | 9.8 | 2024-12-09 | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. |
CVE-2024-12369 | Medium | 4.2 | 2024-12-09 | A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authori… |
CVE-2024-53441 | Critical | 9.1 | 2024-12-09 | An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. |
CVE-2024-54938 | High | 7.5 | 2024-12-09 | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via… |
CVE-2024-54934 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php. |
CVE-2024-54932 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php. |
CVE-2024-54931 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54928 | High | 7.2 | 2024-12-09 | kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php, |
CVE-2024-54927 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php. |
CVE-2024-54925 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL co… |
CVE-2024-54924 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54923 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arb… |
CVE-2024-54921 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command… |
CVE-2024-54918 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. |
CVE-2024-54147 | Medium | 6.8 | 2024-12-09 | Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-i… |
CVE-2024-53847 | | 2024-12-09 | The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. A… | |
CVE-2024-52599 | Medium | 5.4 | 2024-12-09 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tu… |
CVE-2024-52586 | Medium | 5.4 | 2024-12-09 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that a… |
CVE-2024-48956 | Critical | 9.8 | 2024-12-09 | Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint r… |
CVE-2024-46547 | High | 7.5 | 2024-12-09 | A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive informati… |
CVE-2024-12057 | | 2024-12-09 | User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with t… | |
CVE-2024-54935 | Medium | 5.4 | 2024-12-09 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0. This vulner… |
CVE-2024-54933 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php. |
CVE-2024-54930 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php. |