2024 CVEs (page 9)
Page 9 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31854 | High | 8.1 | 2025-07-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed devi… |
CVE-2024-31853 | High | 8.1 | 2025-07-08 | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed devi… |
CVE-2024-43190 | Medium | 5.9 | 2025-07-07 | IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a l… |
CVE-2024-37658 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php. |
CVE-2024-37657 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component. |
CVE-2024-37656 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification i… |
CVE-2024-25178 | Critical | 9.1 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. |
CVE-2024-25177 | High | 7.5 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). |
CVE-2024-25176 | Critical | 9.8 | 2025-07-07 | LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. |
CVE-2024-43334 | High | 7.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affect… |
CVE-2024-58117 | Medium | 4.0 | 2025-07-07 | Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview functio… |
CVE-2024-9453 | Medium | 6.5 | 2025-07-04 | A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are ce… |
CVE-2024-11937 | Medium | 6.4 | 2025-07-04 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all v… |
CVE-2024-5647 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versio… |
CVE-2024-9017 | Medium | 6.4 | 2025-07-03 | The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including… |
CVE-2024-35164 | Medium | 6.8 | 2025-07-02 | The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If… |
CVE-2024-13786 | Critical | 9.8 | 2025-07-02 | The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in… |
CVE-2024-13451 | Medium | 5.3 | 2025-07-02 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-11405 | Medium | 6.1 | 2025-07-02 | The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters… |
CVE-2024-49365 | | 2025-07-01 | tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when glob… | |
CVE-2024-49364 | | 2025-07-01 | tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object… | |
CVE-2024-46993 | | 2025-07-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 3… | |
CVE-2024-46992 | High | 7.8 | 2025-07-01 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30… |
CVE-2024-12915 | Medium | 4.6 | 2025-06-30 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected… |
CVE-2024-53621 | High | 7.5 | 2025-06-30 | A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Servic… |
CVE-2024-8419 | High | 7.5 | 2025-06-30 | The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication. |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2024-52900 | Medium | 6.4 | 2025-06-28 | IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authent… |
CVE-2024-39730 | Medium | 5.4 | 2025-06-28 | IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2024-36347 | Medium | 6.4 | 2025-06-27 | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, pot… |
CVE-2024-12364 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL In… |
CVE-2024-12150 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This… |
CVE-2024-12143 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB… |
CVE-2024-11739 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection. This iss… |
CVE-2024-12827 | Critical | 9.8 | 2025-06-27 | The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includi… |
CVE-2024-52928 | Critical | 9.6 | 2025-06-26 | Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the… |
CVE-2024-56915 | Medium | 6.5 | 2025-06-26 | Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget. |
CVE-2024-6174 | High | 8.8 | 2025-06-26 | When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configuratio… |
CVE-2024-11584 | Medium | 5.9 | 2025-06-26 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-wri… |
CVE-2024-57708 | Medium | 5.7 | 2025-06-25 | An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components… |
CVE-2024-27685 | High | 7.1 | 2025-06-25 | SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload… |
CVE-2024-51984 | Medium | 6.8 | 2025-06-25 | An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If an existing passwor… |
CVE-2024-51983 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken v… |
CVE-2024-51982 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will… |
CVE-2024-51981 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request… |
CVE-2024-51980 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port n… |
CVE-2024-51979 | High | 7.2 | 2025-06-25 | An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS servi… |
CVE-2024-51978 | Critical | 9.8 | 2025-06-25 | An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated att… |
CVE-2024-51977 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak… |
CVE-2024-56917 | High | 7.1 | 2025-06-24 | Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode. |
CVE-2024-37743 | Critical | 9.8 | 2025-06-24 | An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component. |
CVE-2024-56916 | Medium | 6.1 | 2025-06-24 | In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field renderi… |
CVE-2024-56918 | Medium | 6.1 | 2025-06-24 | In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user inp… |
CVE-2024-56731 | Critical | 10.0 | 2025-06-24 | Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote comman… |
CVE-2024-45347 | Critical | 9.6 | 2025-06-23 | An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be expl… |
CVE-2024-3511 | Medium | 4.3 | 2025-06-23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to fla… |
CVE-2024-4994 | High | 8.1 | 2025-06-20 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions sta… |
CVE-2024-4025 | Medium | 6.5 | 2025-06-20 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and… |
CVE-2024-7586 | Medium | 4.1 | 2025-06-20 | An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2024-53298 | Critical | 9.8 | 2025-06-20 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. An unauthenticated attacker with re… |
CVE-2024-24916 | Medium | 6.5 | 2025-06-19 | Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin). |
CVE-2024-45208 | Critical | 9.8 | 2025-06-19 | The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566… |
CVE-2024-54172 | Medium | 4.3 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which… |
CVE-2024-54183 | Medium | 5.4 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulne… |
CVE-2024-40570 | Medium | 6.5 | 2025-06-17 | SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component. |
CVE-2024-25573 | | 2025-06-15 | Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. | |
CVE-2024-38824 | Critical | 9.6 | 2025-06-13 | Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. |
CVE-2024-38825 | Medium | 6.4 | 2025-06-13 | The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate… |
CVE-2024-38823 | Low | 2.7 | 2025-06-13 | Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. |
CVE-2024-38822 | Low | 2.7 | 2025-06-13 | Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. |
CVE-2024-55567 | High | 7.5 | 2025-06-12 | Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before… |
CVE-2024-7562 | | 2025-06-12 | A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured… | |
CVE-2024-44906 | Medium | 6.5 | 2025-06-12 | uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated th… |
CVE-2024-44905 | Medium | 6.5 | 2025-06-12 | go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go. |
CVE-2024-56158 | Critical | 9.8 | 2025-06-12 | XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query val… |
CVE-2024-9512 | Medium | 5.3 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible… |
CVE-2024-35295 | Medium | 6.1 | 2025-06-11 | A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 20… |
CVE-2024-1244 | | 2025-06-11 | Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession… | |
CVE-2024-1243 | High | 7.2 | 2025-06-11 | Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure… |
CVE-2024-9062 | High | 7.8 | 2025-06-11 | The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.ar… |
CVE-2024-8270 | Medium | 5.5 | 2025-06-11 | The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploit… |
CVE-2024-7457 | High | 7.8 | 2025-06-11 | The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's… |
CVE-2024-41505 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor). |
CVE-2024-41504 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS). In the "Oportunidades" (opportunities) section of the application when c… |
CVE-2024-41503 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca"… |
CVE-2024-41502 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons)… |
CVE-2024-37396 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2024-37395 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or… |
CVE-2024-37394 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2024-57190 | Critical | 9.8 | 2025-06-10 | Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowin… |
CVE-2024-57189 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL… |
CVE-2024-57186 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler. |
CVE-2024-54019 | Medium | 4.8 | 2025-06-10 | A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow… |
CVE-2024-50568 | Medium | 5.9 | 2025-06-10 | A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProx… |
CVE-2024-50562 | Medium | 4.8 | 2025-06-10 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version… |
CVE-2024-45329 | Medium | 4.3 | 2025-06-10 | A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may a… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2024-32119 | Medium | 4.8 | 2025-06-10 | An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowle… |
CVE-2024-41797 | Medium | 4.3 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), S… |
CVE-2024-40625 | Medium | 5.5 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{store… |