2024 CVEs (page 85)
Page 85 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12186 | Medium | 5.3 | 2024-12-05 | A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file ho… |
CVE-2024-12185 | Medium | 5.3 | 2024-12-05 | A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the compo… |
CVE-2024-53982 | | 2024-12-04 | ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo examp… | |
CVE-2024-12183 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of t… |
CVE-2024-12182 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /memb… |
CVE-2024-12181 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_… |
CVE-2024-12180 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulat… |
CVE-2024-54675 | Medium | 6.1 | 2024-12-04 | app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow. |
CVE-2024-54674 | Medium | 6.1 | 2024-12-04 | app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format. |
CVE-2024-51210 | Medium | 5.3 | 2024-12-04 | Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previo… |
CVE-2024-50947 | High | 7.5 | 2024-12-04 | An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request. |
CVE-2024-39219 | High | 8.8 | 2024-12-04 | An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, expo… |
CVE-2024-38829 | Low | 3.7 | 2024-12-04 | A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through… |
CVE-2024-48453 | Critical | 9.8 | 2024-12-04 | An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function |
CVE-2024-12196 | Medium | 6.5 | 2024-12-04 | Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of a… |
CVE-2024-12151 | Medium | 5.0 | 2024-12-04 | Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. |
CVE-2024-12149 | High | 8.1 | 2024-12-04 | Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authe… |
CVE-2024-12148 | Medium | 4.3 | 2024-12-04 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting e… |
CVE-2024-12147 | Medium | 6.5 | 2024-12-04 | A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-52676 | Medium | 5.4 | 2024-12-04 | Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php. |
CVE-2024-39163 | High | 8.8 | 2024-12-04 | binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints. |
CVE-2024-20397 | Medium | 5.2 | 2024-12-04 | A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticat… |
CVE-2024-54134 | | 2024-12-04 | A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish… | |
CVE-2024-54132 | | 2024-12-04 | The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unint… | |
CVE-2024-54002 | Medium | 5.3 | 2024-12-04 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login reques… |
CVE-2024-53614 | Medium | 6.5 | 2024-12-04 | A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges. |
CVE-2024-37575 | High | 7.5 | 2024-12-04 | The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without u… |
CVE-2024-37574 | High | 8.2 | 2024-12-04 | The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interact… |
CVE-2024-11643 | High | 8.8 | 2024-12-04 | The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missi… |
CVE-2024-53140 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: netlink: terminate outstanding dump on socket close Netlink supports iterative dumping of… |
CVE-2024-53139 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix possible UAF in sctp_v6_available() A lockdep report [1] with CONFIG_PROVE_RCU_… |
CVE-2024-53138 | Critical | 9.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix… |
CVE-2024-53137 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for… |
CVE-2024-53136 | High | 7.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm: revert "mm: shmem: fix data-race in shmem_getattr()" Revert d949d1d14fa2 ("mm: shmem… |
CVE-2024-53135 | High | 8.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's… |
CVE-2024-53134 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i < bc->onec… |
CVE-2024-53133 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle dml allocation failure to avoid crash [Why] In the case where a d… |
CVE-2024-53132 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix "Missing outer runtime PM protection" warning Fix the following drm_WARN: … |
CVE-2024-53131 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint Patch series "nilfs2: fix nul… |
CVE-2024-53130 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint When using the "block:block_d… |
CVE-2024-53129 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: Fix a dereferenced before check warning The 'state' can't be NULL, we… |
CVE-2024-53128 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers When CONFIG_KASAN_SW… |
CVE-2024-53127 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" The commit 8396c793ff… |
CVE-2024-53126 | High | 7.1 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: vdpa: solidrun: Fix UB bug with devres In psnet_open_pf_bar() and snet_open_vf_bar() a st… |
CVE-2024-40745 | Medium | 5.4 | 2024-12-04 | Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. |
CVE-2024-40744 | Critical | 9.8 | 2024-12-04 | Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. |
CVE-2024-12056 | | 2024-12-04 | The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a… | |
CVE-2024-7488 | Medium | 5.3 | 2024-12-04 | Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks… |
CVE-2024-53125 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg… |
CVE-2024-51465 | High | 8.8 | 2024-12-04 | IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary co… |
CVE-2024-12138 | Medium | 6.3 | 2024-12-04 | A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimburs… |
CVE-2024-11935 | Medium | 6.4 | 2024-12-04 | The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including… |
CVE-2024-8962 | Medium | 6.4 | 2024-12-04 | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and… |
CVE-2024-8894 | | 2024-12-04 | Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on rec… | |
CVE-2024-54158 | Low | 3.5 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding |
CVE-2024-54157 | Medium | 4.3 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector |
CVE-2024-54156 | Medium | 4.2 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-52269 | High | 8.1 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content t… |
CVE-2024-11854 | Medium | 6.4 | 2024-12-04 | The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortc… |
CVE-2024-10576 | | 2024-12-04 | Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with… | |
CVE-2024-52277 | | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flatt… | |
CVE-2024-52276 | High | 7.5 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer f… |
CVE-2024-52275 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Ten… |
CVE-2024-52274 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig->guest_ip_check(overflow arg: mask) modules) allows… |
CVE-2024-52273 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig->guest_ip_check(overflow arg: mask) modules) allows… |
CVE-2024-52272 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromAdvSetLanip(overflow arg:lanMask) modules) allows Overflow Buffers.T… |
CVE-2024-12107 | High | 7.5 | 2024-12-04 | Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint Identifier allows remote attacker to reliably cause DoS |
CVE-2024-11814 | Medium | 6.1 | 2024-12-04 | The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwp_wcos_delete_finished, wfwp… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-11952 | High | 7.5 | 2024-12-04 | The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via… |
CVE-2024-11880 | Medium | 6.4 | 2024-12-04 | The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in a… |
CVE-2024-10787 | Medium | 4.3 | 2024-12-04 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'element… |
CVE-2024-10567 | High | 7.5 | 2024-12-04 | The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function… |
CVE-2024-11903 | Medium | 6.4 | 2024-12-04 | The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in all versions up to, and including, 1.3.90… |
CVE-2024-11769 | Medium | 6.4 | 2024-12-04 | The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versio… |
CVE-2024-11466 | Medium | 6.1 | 2024-12-04 | The Intro Tour Tutorial DeepPresentation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, an… |
CVE-2024-11293 | High | 8.1 | 2024-12-04 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login… |
CVE-2024-10664 | Medium | 4.3 | 2024-12-04 | The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2024-45717 | High | 7.0 | 2024-12-04 | The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability r… |
CVE-2024-11398 | High | 8.1 | 2024-12-04 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before… |
CVE-2024-54661 | Critical | 9.8 | 2024-12-04 | readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file. |
CVE-2024-9404 | High | 7.5 | 2024-12-04 | This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows a… |
CVE-2024-12123 | | 2024-12-04 | A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated us… | |
CVE-2024-12099 | Medium | 4.3 | 2024-12-04 | The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0… |
CVE-2024-10885 | Medium | 6.4 | 2024-12-04 | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions… |
CVE-2024-11897 | Medium | 6.4 | 2024-12-04 | The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcod… |
CVE-2024-11813 | Medium | 6.1 | 2024-12-04 | The Pulsating Chat Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.1. This is due to missing… |
CVE-2024-11807 | Medium | 6.1 | 2024-12-04 | The NPS computy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data1' and 'data2' parameters in all versions up to, and includin… |
CVE-2024-11747 | Medium | 6.4 | 2024-12-04 | The Responsive Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'somryv' shortcode in all versions up to, and includin… |
CVE-2024-11093 | Medium | 5.5 | 2024-12-04 | The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due to insufficient input sanitization and… |
CVE-2024-10952 | High | 7.3 | 2024-12-04 | The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all versions up to, and in… |
CVE-2024-10832 | Medium | 6.1 | 2024-12-04 | The Posti Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the account_number and secret_key parameters in all versions up to… |
CVE-2024-10663 | Medium | 4.3 | 2024-12-04 | The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-10587 | High | 8.8 | 2024-12-04 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection… |
CVE-2024-45207 | High | 7.0 | 2024-12-04 | DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directorie… |
CVE-2024-45206 | Medium | 6.5 | 2024-12-04 | A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and ge… |
CVE-2024-45205 | High | 7.1 | 2024-12-04 | An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious… |