2024 CVEs (page 89)
Page 89 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20127 | High | 7.5 | 2024-12-02 | In Telephony, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution pr… |
CVE-2024-20125 | Medium | 6.7 | 2024-12-02 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2024-20116 | Medium | 4.4 | 2024-12-02 | In cmdq, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-11856 | Low | 3.7 | 2024-12-02 | A security vulnerability in HPE IceWall products could be exploited remotely to cause Unauthorized Data Modification. |
CVE-2024-53605 | High | 7.5 | 2024-12-02 | Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows attackers to access s… |
CVE-2024-12007 | Medium | 6.3 | 2024-12-01 | A vulnerability, which was classified as critical, was found in code-projects Farmacia 1.0. This affects an unknown part of the file /visualizar-produto.php. T… |
CVE-2024-53752 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berg Informatik Stripe Donation bin-stripe-donation allow… |
CVE-2024-53750 | High | 7.1 | 2024-12-01 | Cross-Site Request Forgery (CSRF) vulnerability in Maeve Lander PayPal Responder allows Stored XSS.This issue affects PayPal Responder: from n/a through 1.2. |
CVE-2024-53749 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carou… |
CVE-2024-53748 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Mermaid wp-mermaid allows Stored XSS.This iss… |
CVE-2024-53747 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nutttaro Video Player for WPBakery video-player-for-wpbak… |
CVE-2024-53746 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Elementor Button Plus fd-elementor-button-plus… |
CVE-2024-53745 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 코스모스팜 – Cosmosfarm 소셜 공유 버튼 By 코스모스팜 cosmosfarm-share-but… |
CVE-2024-53744 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portf… |
CVE-2024-53743 | Medium | 6.5 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh Countdown Timer for Elementor countdown-time… |
CVE-2024-53742 | High | 7.1 | 2024-12-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism I.T. Systems Multilevel Referral Affiliate Plugin f… |
CVE-2024-45520 | High | 7.5 | 2024-12-01 | WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. |
CVE-2024-53786 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeless Cowidgets – Elementor Addons cowidgets-elementor… |
CVE-2024-53778 | High | 7.1 | 2024-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Stored XSS.This issue affects Essentia… |
CVE-2024-53774 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit al… |
CVE-2024-53773 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pracapl Znajdź Pracę z Praca.pl znajdz-prace-z-pracapl al… |
CVE-2024-53772 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS… |
CVE-2024-53771 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sergiomico SimpleSchema simpleschema-free allows DOM-Base… |
CVE-2024-53767 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows DOM-B… |
CVE-2024-53766 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elem… |
CVE-2024-53764 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Softtemplates For Elementor softtemplates-for-… |
CVE-2024-53763 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rejuan Ahamed Best Addons for Elementor allows Stored XSS… |
CVE-2024-53760 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Capitalize My Title Capitalize My Title capitalize-my-tit… |
CVE-2024-53758 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP MathJax wp-mathjax-plus allows Stored XSS.Thi… |
CVE-2024-53757 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest… |
CVE-2024-53756 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aftab Husain Vertical Carousel vertical-carousel-slider a… |
CVE-2024-53788 | Medium | 5.9 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gall… |
CVE-2024-53787 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Store… |
CVE-2024-53783 | High | 7.6 | 2024-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-c… |
CVE-2024-53768 | Medium | 5.3 | 2024-11-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows… |
CVE-2024-53739 | High | 8.1 | 2024-11-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets Fo… |
CVE-2024-53738 | Medium | 4.4 | 2024-11-30 | Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issu… |
CVE-2024-12002 | Medium | 4.3 | 2024-11-30 | A vulnerability classified as problematic was found in Tenda FH451, FH1201, FH1202 and FH1206 up to 20241129. Affected by this vulnerability is the function we… |
CVE-2024-12001 | Low | 3.5 | 2024-11-30 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updateset… |
CVE-2024-12000 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /con… |
CVE-2024-11998 | Medium | 6.3 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forn… |
CVE-2024-11997 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manip… |
CVE-2024-11996 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar… |
CVE-2024-11252 | Medium | 6.1 | 2024-11-30 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2024-43703 | High | 8.1 | 2024-11-30 | Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the… |
CVE-2024-43702 | High | 8.1 | 2024-11-30 | Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page. |
CVE-2024-53623 | High | 7.5 | 2024-11-29 | Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information. |
CVE-2024-54159 | Medium | 4.1 | 2024-11-29 | stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. |
CVE-2024-11995 | Low | 3.5 | 2024-11-29 | A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-53507 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. |
CVE-2024-53506 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. |
CVE-2024-53505 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. |
CVE-2024-53504 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. |
CVE-2024-36612 | High | 7.5 | 2024-11-29 | Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. |
CVE-2024-35371 | High | 7.5 | 2024-11-29 | Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mech… |
CVE-2024-35368 | Critical | 9.8 | 2024-11-29 | FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. |
CVE-2024-35367 | Critical | 9.1 | 2024-11-29 | FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer |
CVE-2024-35366 | Critical | 9.1 | 2024-11-29 | FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain optio… |
CVE-2024-53983 | Medium | 5.4 | 2024-11-29 | The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder templ… |
CVE-2024-53980 | High | 7.5 | 2024-11-29 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A m… |
CVE-2024-53979 | High | 8.2 | 2024-11-29 | ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file… |
CVE-2024-53865 | High | 8.2 | 2024-11-29 | zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like proper… |
CVE-2024-53864 | | 2024-11-29 | Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one o… | |
CVE-2024-53861 | Low | 2.2 | 2024-11-29 | pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`… |
CVE-2024-53848 | High | 7.1 | 2024-11-29 | check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of… |
CVE-2024-52810 | | 2024-11-29 | @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the en… | |
CVE-2024-52809 | | 2024-11-29 | vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale m… | |
CVE-2024-52801 | | 2024-11-29 | sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implem… | |
CVE-2024-52800 | | 2024-11-29 | veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may th… | |
CVE-2024-52003 | Medium | 6.1 | 2024-11-29 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-… |
CVE-2024-36616 | Medium | 6.5 | 2024-11-29 | An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafte… |
CVE-2024-36615 | Medium | 5.9 | 2024-11-29 | FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side… |
CVE-2024-36611 | High | 7.5 | 2024-11-29 | In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the usernam… |
CVE-2024-49360 | Critical | 9.2 | 2024-11-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges… |
CVE-2024-36624 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js. |
CVE-2024-36623 | High | 8.1 | 2024-11-29 | moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations result… |
CVE-2024-36622 | Critical | 9.8 | 2024-11-29 | In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitizati… |
CVE-2024-36621 | Medium | 6.5 | 2024-11-29 | moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds t… |
CVE-2024-36620 | Medium | 6.5 | 2024-11-29 | moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. |
CVE-2024-36618 | Medium | 6.2 | 2024-11-29 | FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-serv… |
CVE-2024-36617 | Medium | 6.2 | 2024-11-29 | FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. |
CVE-2024-49806 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49805 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49804 | High | 7.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to un… |
CVE-2024-49803 | Critical | 9.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a… |
CVE-2024-47193 | Medium | 5.5 | 2024-11-29 | WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow a remote Denial of Service. |
CVE-2024-36626 | Medium | 5.3 | 2024-11-29 | In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php. |
CVE-2024-36625 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts. |
CVE-2024-36619 | Medium | 5.3 | 2024-11-29 | FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leadi… |
CVE-2024-35369 | Medium | 5.5 | 2024-11-29 | In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certai… |
CVE-2024-52782 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52781 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/tool/tr… |
CVE-2024-52780 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/m… |
CVE-2024-52779 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52778 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52777 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L, <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/… |
CVE-2024-48406 | Critical | 9.8 | 2024-11-29 | Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, u… |
CVE-2024-36671 | Critical | 9.8 | 2024-11-29 | nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. |
CVE-2024-11992 | Critical | 9.1 | 2024-11-29 | Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and dow… |
CVE-2024-11990 | Medium | 4.6 | 2024-11-29 | A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected in… |