2024 CVEs (page 85)
Page 85 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51542 | High | 8.2 | 2024-12-05 | Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Ser… |
CVE-2024-51541 | High | 8.2 | 2024-12-05 | Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08… |
CVE-2024-48847 | High | 8.2 | 2024-12-05 | MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affect… |
CVE-2024-48846 | High | 7.1 | 2024-12-05 | Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected product… |
CVE-2024-48845 | Critical | 9.4 | 2024-12-05 | Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/appli… |
CVE-2024-48844 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48843 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48840 | Critical | 10.0 | 2024-12-05 | Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series… |
CVE-2024-48839 | Critical | 10.0 | 2024-12-05 | Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX S… |
CVE-2024-12094 | | 2024-12-05 | This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical a… | |
CVE-2024-11317 | Critical | 10.0 | 2024-12-05 | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. … |
CVE-2024-11316 | High | 7.5 | 2024-12-05 | Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-52270 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show… | |
CVE-2024-52564 | High | 7.5 | 2024-12-05 | Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote… |
CVE-2024-47133 | High | 7.2 | 2024-12-05 | UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to exec… |
CVE-2024-45841 | Medium | 6.5 | 2024-12-05 | Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an… |
CVE-2024-11779 | Medium | 6.4 | 2024-12-05 | The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in al… |
CVE-2024-11420 | Medium | 6.4 | 2024-12-05 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2… |
CVE-2024-11341 | Medium | 4.3 | 2024-12-05 | The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or in… |
CVE-2024-11324 | Medium | 6.1 | 2024-12-05 | The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-10848 | Medium | 6.4 | 2024-12-05 | The NewsMunch theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.35 due to… |
CVE-2024-10777 | Medium | 4.3 | 2024-12-05 | The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' short… |
CVE-2024-10056 | Medium | 6.4 | 2024-12-05 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's livesite-pay shortcode in all versions up… |
CVE-2024-10937 | Medium | 5.3 | 2024-12-05 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information E… |
CVE-2024-11429 | High | 8.8 | 2024-12-05 | The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in… |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-10178 | Medium | 6.4 | 2024-12-05 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdow… |
CVE-2024-10881 | Medium | 6.4 | 2024-12-05 | The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lunaradio' shortcode in versions up to, and including, 6.24.11… |
CVE-2024-54014 | Low | 3.6 | 2024-12-05 | Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allo… |
CVE-2024-12188 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-12187 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /show… |
CVE-2024-54221 | Critical | 9.3 | 2024-12-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This is… |
CVE-2024-12186 | Medium | 5.3 | 2024-12-05 | A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file ho… |
CVE-2024-12185 | Medium | 5.3 | 2024-12-05 | A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the compo… |
CVE-2024-53982 | | 2024-12-04 | ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo examp… | |
CVE-2024-12183 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of t… |
CVE-2024-12182 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /memb… |
CVE-2024-12181 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_… |
CVE-2024-12180 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulat… |
CVE-2024-54675 | Medium | 6.1 | 2024-12-04 | app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow. |
CVE-2024-54674 | Medium | 6.1 | 2024-12-04 | app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format. |
CVE-2024-51210 | Medium | 5.3 | 2024-12-04 | Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previo… |
CVE-2024-50947 | High | 7.5 | 2024-12-04 | An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request. |
CVE-2024-39219 | High | 8.8 | 2024-12-04 | An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, expo… |
CVE-2024-38829 | Low | 3.7 | 2024-12-04 | A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through… |
CVE-2024-48453 | Critical | 9.8 | 2024-12-04 | An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function |
CVE-2024-12196 | Medium | 6.5 | 2024-12-04 | Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of a… |
CVE-2024-12151 | Medium | 5.0 | 2024-12-04 | Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. |
CVE-2024-12149 | High | 8.1 | 2024-12-04 | Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authe… |
CVE-2024-12148 | Medium | 4.3 | 2024-12-04 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting e… |
CVE-2024-12147 | Medium | 6.5 | 2024-12-04 | A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-52676 | Medium | 5.4 | 2024-12-04 | Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php. |
CVE-2024-39163 | High | 8.8 | 2024-12-04 | binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints. |
CVE-2024-20397 | Medium | 5.2 | 2024-12-04 | A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticat… |
CVE-2024-54134 | | 2024-12-04 | A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish… | |
CVE-2024-54132 | | 2024-12-04 | The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unint… | |
CVE-2024-54002 | Medium | 5.3 | 2024-12-04 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login reques… |
CVE-2024-53614 | Medium | 6.5 | 2024-12-04 | A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges. |
CVE-2024-37575 | High | 7.5 | 2024-12-04 | The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without u… |
CVE-2024-37574 | High | 8.2 | 2024-12-04 | The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interact… |
CVE-2024-11643 | High | 8.8 | 2024-12-04 | The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missi… |
CVE-2024-53140 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: netlink: terminate outstanding dump on socket close Netlink supports iterative dumping of… |
CVE-2024-53139 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix possible UAF in sctp_v6_available() A lockdep report [1] with CONFIG_PROVE_RCU_… |
CVE-2024-53138 | Critical | 9.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix… |
CVE-2024-53137 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for… |
CVE-2024-53136 | High | 7.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm: revert "mm: shmem: fix data-race in shmem_getattr()" Revert d949d1d14fa2 ("mm: shmem… |
CVE-2024-53135 | High | 8.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's… |
CVE-2024-53134 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i < bc->onec… |
CVE-2024-53133 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle dml allocation failure to avoid crash [Why] In the case where a d… |
CVE-2024-53132 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix "Missing outer runtime PM protection" warning Fix the following drm_WARN: … |
CVE-2024-53131 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint Patch series "nilfs2: fix nul… |
CVE-2024-53130 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint When using the "block:block_d… |
CVE-2024-53129 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: Fix a dereferenced before check warning The 'state' can't be NULL, we… |
CVE-2024-53128 | Medium | 5.5 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers When CONFIG_KASAN_SW… |
CVE-2024-53127 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" The commit 8396c793ff… |
CVE-2024-53126 | High | 7.1 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: vdpa: solidrun: Fix UB bug with devres In psnet_open_pf_bar() and snet_open_vf_bar() a st… |
CVE-2024-40745 | Medium | 5.4 | 2024-12-04 | Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. |
CVE-2024-40744 | Critical | 9.8 | 2024-12-04 | Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. |
CVE-2024-12056 | | 2024-12-04 | The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a… | |
CVE-2024-7488 | Medium | 5.3 | 2024-12-04 | Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks… |
CVE-2024-53125 | High | 7.8 | 2024-12-04 | In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg… |
CVE-2024-51465 | High | 8.8 | 2024-12-04 | IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary co… |
CVE-2024-12138 | Medium | 6.3 | 2024-12-04 | A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimburs… |
CVE-2024-11935 | Medium | 6.4 | 2024-12-04 | The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including… |
CVE-2024-8962 | Medium | 6.4 | 2024-12-04 | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and… |
CVE-2024-8894 | | 2024-12-04 | Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on rec… | |
CVE-2024-54158 | Low | 3.5 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding |
CVE-2024-54157 | Medium | 4.3 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector |
CVE-2024-54156 | Medium | 4.2 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-52269 | High | 8.1 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content t… |
CVE-2024-11854 | Medium | 6.4 | 2024-12-04 | The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortc… |
CVE-2024-10576 | | 2024-12-04 | Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with… | |
CVE-2024-52277 | | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flatt… | |
CVE-2024-52276 | High | 7.5 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer f… |
CVE-2024-52275 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Ten… |
CVE-2024-52274 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig->guest_ip_check(overflow arg: mask) modules) allows… |
CVE-2024-52273 | Critical | 9.8 | 2024-12-04 | Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig->guest_ip_check(overflow arg: mask) modules) allows… |