2024 CVEs (page 9)
Page 9 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11739 | Critical | 9.8 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection. This iss… |
CVE-2024-12827 | Critical | 9.8 | 2025-06-27 | The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includi… |
CVE-2024-52928 | Critical | 9.6 | 2025-06-26 | Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the… |
CVE-2024-56915 | Medium | 6.5 | 2025-06-26 | Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget. |
CVE-2024-6174 | High | 8.8 | 2025-06-26 | When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configuratio… |
CVE-2024-11584 | Medium | 5.9 | 2025-06-26 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-wri… |
CVE-2024-57708 | Medium | 5.7 | 2025-06-25 | An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components… |
CVE-2024-27685 | High | 7.1 | 2025-06-25 | SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload… |
CVE-2024-51984 | Medium | 6.8 | 2025-06-25 | An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If an existing passwor… |
CVE-2024-51983 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken v… |
CVE-2024-51982 | High | 7.5 | 2025-06-25 | An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will… |
CVE-2024-51981 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request… |
CVE-2024-51980 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port n… |
CVE-2024-51979 | High | 7.2 | 2025-06-25 | An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS servi… |
CVE-2024-51978 | Critical | 9.8 | 2025-06-25 | An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated att… |
CVE-2024-51977 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak… |
CVE-2024-56917 | High | 7.1 | 2025-06-24 | Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode. |
CVE-2024-37743 | Critical | 9.8 | 2025-06-24 | An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component. |
CVE-2024-56916 | Medium | 6.1 | 2025-06-24 | In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field renderi… |
CVE-2024-56918 | Medium | 6.1 | 2025-06-24 | In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user inp… |
CVE-2024-56731 | Critical | 10.0 | 2025-06-24 | Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote comman… |
CVE-2024-45347 | Critical | 9.6 | 2025-06-23 | An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be expl… |
CVE-2024-3511 | Medium | 4.3 | 2025-06-23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to fla… |
CVE-2024-4994 | High | 8.1 | 2025-06-20 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions sta… |
CVE-2024-4025 | Medium | 6.5 | 2025-06-20 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and… |
CVE-2024-7586 | Medium | 4.1 | 2025-06-20 | An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2024-53298 | Critical | 9.8 | 2025-06-20 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. An unauthenticated attacker with re… |
CVE-2024-24916 | Medium | 6.5 | 2025-06-19 | Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin). |
CVE-2024-45208 | Critical | 9.8 | 2025-06-19 | The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566… |
CVE-2024-54172 | Medium | 4.3 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which… |
CVE-2024-54183 | Medium | 5.4 | 2025-06-18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulne… |
CVE-2024-40570 | Medium | 6.5 | 2025-06-17 | SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component. |
CVE-2024-25573 | | 2025-06-15 | Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. | |
CVE-2024-38824 | Critical | 9.6 | 2025-06-13 | Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. |
CVE-2024-38825 | Medium | 6.4 | 2025-06-13 | The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate… |
CVE-2024-38823 | Low | 2.7 | 2025-06-13 | Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. |
CVE-2024-38822 | Low | 2.7 | 2025-06-13 | Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. |
CVE-2024-55567 | High | 7.5 | 2025-06-12 | Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before… |
CVE-2024-7562 | | 2025-06-12 | A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured… | |
CVE-2024-44906 | Medium | 6.5 | 2025-06-12 | uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated th… |
CVE-2024-44905 | Medium | 6.5 | 2025-06-12 | go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go. |
CVE-2024-56158 | Critical | 9.8 | 2025-06-12 | XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query val… |
CVE-2024-9512 | Medium | 5.3 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible… |
CVE-2024-35295 | Medium | 6.1 | 2025-06-11 | A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 20… |
CVE-2024-1244 | | 2025-06-11 | Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession… | |
CVE-2024-1243 | High | 7.2 | 2025-06-11 | Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure… |
CVE-2024-9062 | High | 7.8 | 2025-06-11 | The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.ar… |
CVE-2024-8270 | Medium | 5.5 | 2025-06-11 | The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploit… |
CVE-2024-7457 | High | 7.8 | 2025-06-11 | The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's… |
CVE-2024-41505 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor). |
CVE-2024-41504 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS). In the "Oportunidades" (opportunities) section of the application when c… |
CVE-2024-41503 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca"… |
CVE-2024-41502 | Medium | 6.1 | 2025-06-10 | Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons)… |
CVE-2024-37396 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2024-37395 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or… |
CVE-2024-37394 | Medium | 5.4 | 2025-06-10 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML… |
CVE-2024-57190 | Critical | 9.8 | 2025-06-10 | Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowin… |
CVE-2024-57189 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL… |
CVE-2024-57186 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler. |
CVE-2024-54019 | Medium | 4.8 | 2025-06-10 | A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow… |
CVE-2024-50568 | Medium | 5.9 | 2025-06-10 | A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProx… |
CVE-2024-50562 | Medium | 4.8 | 2025-06-10 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version… |
CVE-2024-45329 | Medium | 4.3 | 2025-06-10 | A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may a… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2024-32119 | Medium | 4.8 | 2025-06-10 | An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowle… |
CVE-2024-41797 | Medium | 4.3 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), S… |
CVE-2024-40625 | Medium | 5.5 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{store… |
CVE-2024-38524 | Medium | 5.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletReques… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2024-29198 | High | 7.5 | 2025-06-10 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Fo… |
CVE-2024-13090 | High | 7.0 | 2025-06-10 | A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local service account were exce… |
CVE-2024-13089 | High | 7.2 | 2025-06-10 | An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. … |
CVE-2024-47081 | Medium | 5.3 | 2025-06-09 | Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously… |
CVE-2024-46452 | Medium | 6.1 | 2025-06-09 | A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim user… |
CVE-2024-55585 | | 2025-06-07 | In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write… | |
CVE-2024-9994 | Medium | 6.4 | 2025-06-07 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-9993 | Medium | 6.4 | 2025-06-07 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-56805 | Medium | 5.4 | 2025-06-06 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attacker… |
CVE-2024-50406 | Medium | 5.4 | 2025-06-06 | A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have ga… |
CVE-2024-13088 | High | 7.8 | 2025-06-06 | An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability… |
CVE-2024-13087 | Medium | 6.7 | 2025-06-06 | A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, t… |
CVE-2024-58114 | Medium | 4.0 | 2025-06-06 | Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-46941 | | 2025-06-06 | SystemUI has an incorrect component protection setting, which allows access to specific information. | |
CVE-2024-56343 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow an authenticated user to crash the service with a specially crafted POST request. |
CVE-2024-56342 | Medium | 4.3 | 2025-06-06 | IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is r… |
CVE-2024-22330 | Medium | 5.9 | 2025-06-06 | IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise us… |
CVE-2024-13967 | High | 8.8 | 2025-06-04 | This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. … |
CVE-2024-31127 | High | 7.3 | 2025-06-04 | An improper verification of a loaded library in Zscaler Client Connector on Mac < 4.2.0.241 may allow a local attacker to elevate their privileges. |
CVE-2024-45655 | Medium | 5.5 | 2025-06-03 | IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. |
CVE-2024-12718 | Medium | 5.3 | 2025-06-03 | Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction direc… |
CVE-2024-54189 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-52561 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-36486 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When… |
CVE-2024-53026 | High | 8.2 | 2025-06-03 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. |
CVE-2024-53021 | High | 8.2 | 2025-06-03 | Information disclosure may occur while processing goodbye RTCP packet from network. |
CVE-2024-53020 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. |
CVE-2024-53019 | High | 8.2 | 2025-06-03 | Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources. |
CVE-2024-53018 | Medium | 6.6 | 2025-06-03 | Memory corruption may occur while processing the OIS packet parser. |
CVE-2024-53017 | Medium | 6.6 | 2025-06-03 | Memory corruption while handling test pattern generator IOCTL command. |
CVE-2024-53016 | Medium | 6.6 | 2025-06-03 | Memory corruption while processing I2C settings in Camera driver. |