2024 CVEs (page 97)
Page 97 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5722 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2024-5721 | High | 8.1 | 2024-11-22 | Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-5720 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5719 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5718 | High | 8.1 | 2024-11-22 | Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-5717 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5716 | Critical | 9.8 | 2024-11-22 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installati… |
CVE-2024-5581 | High | 7.2 | 2024-11-22 | Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins… |
CVE-2024-5580 | High | 7.2 | 2024-11-22 | Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5579 | High | 7.2 | 2024-11-22 | Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-5513 | High | 7.8 | 2024-11-22 | Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-5512 | Medium | 5.5 | 2024-11-22 | Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-5511 | High | 7.8 | 2024-11-22 | Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-5510 | High | 7.8 | 2024-11-22 | Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-53253 | Medium | 5.3 | 2024-11-22 | Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error… |
CVE-2024-47863 | Medium | 6.2 | 2024-11-22 | An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22… |
CVE-2024-30377 | High | 7.8 | 2024-11-22 | G DATA Total Security Scan Server Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2024-30376 | High | 7.3 | 2024-11-22 | Famatech Advanced IP Scanner Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p… |
CVE-2024-30372 | Medium | 6.3 | 2024-11-22 | Allegra getLinkText Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-1868 | High | 7.8 | 2024-11-22 | G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected ins… |
CVE-2024-1867 | High | 7.8 | 2024-11-22 | G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected ins… |
CVE-2024-52998 | Medium | 5.5 | 2024-11-22 | Substance3D - Stager versions 3.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-52726 | High | 7.5 | 2024-11-22 | CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information |
CVE-2024-11618 | High | 7.3 | 2024-11-22 | A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-50657 | Medium | 6.8 | 2024-11-22 | An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the che… |
CVE-2024-37783 | Medium | 5.4 | 2024-11-22 | A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScript into the web bro… |
CVE-2024-37782 | Critical | 9.8 | 2024-11-22 | An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary comm… |
CVE-2024-53438 | Critical | 9.8 | 2024-11-22 | EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which… |
CVE-2024-44786 | High | 7.5 | 2024-11-22 | Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors. |
CVE-2024-10220 | High | 8.1 | 2024-11-22 | The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.2… |
CVE-2024-52814 | Low | 2.8 | 2024-11-22 | Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in… |
CVE-2024-52804 | High | 7.5 | 2024-11-22 | Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes… |
CVE-2024-52802 | High | 7.5 | 2024-11-22 | RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/applicati… |
CVE-2024-52793 | | 2024-11-22 | The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing: true` option is vu… | |
CVE-2024-52723 | Critical | 9.8 | 2024-11-22 | In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arb… |
CVE-2024-51074 | Medium | 6.7 | 2024-11-22 | Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in t… |
CVE-2024-51073 | Medium | 6.7 | 2024-11-22 | An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrume… |
CVE-2024-51072 | Medium | 5.3 | 2024-11-22 | An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service… |
CVE-2024-50965 | Medium | 5.4 | 2024-11-22 | Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and esc… |
CVE-2024-50401 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50400 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50399 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50398 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50397 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50396 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50395 | High | 8.8 | 2024-11-22 | An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could all… |
CVE-2024-48862 | Critical | 9.8 | 2024-11-22 | A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file syst… |
CVE-2024-48861 | High | 7.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers… |
CVE-2024-48860 | Critical | 9.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-38647 | High | 7.5 | 2024-11-22 | An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to co… |
CVE-2024-38646 | Medium | 6.0 | 2024-11-22 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow… |
CVE-2024-38645 | Medium | 6.5 | 2024-11-22 | A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticate… |
CVE-2024-38644 | High | 8.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers t… |
CVE-2024-38643 | Critical | 9.8 | 2024-11-22 | A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote at… |
CVE-2024-37050 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37049 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37048 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37047 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37046 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-37045 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37044 | High | 7.2 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37043 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-37042 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37041 | High | 7.2 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-32770 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32769 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32768 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32767 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-10863 | | 2024-11-22 | : Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: fro… | |
CVE-2024-49054 | Medium | 4.3 | 2024-11-22 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-45719 | Low | 2.6 | 2024-11-22 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version a… |
CVE-2024-51766 | Medium | 6.5 | 2024-11-22 | A potential security vulnerability has been identified in the HPE NonStop DISK UTIL (T9208) product. This vulnerability could be exploited to cause a denial of… |
CVE-2024-41781 | Medium | 5.1 | 2024-11-22 | IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 throug… |
CVE-2024-41779 | Critical | 9.8 | 2024-11-22 | IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race conditi… |
CVE-2024-7882 | Medium | 6.5 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL I… |
CVE-2024-7837 | High | 8.2 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection. This issue a… |
CVE-2024-8929 | Medium | 5.8 | 2024-11-22 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap… |
CVE-2024-9422 | Medium | 6.6 | 2024-11-22 | The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could al… |
CVE-2024-8932 | Critical | 9.8 | 2024-11-22 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can… |
CVE-2024-8735 | Medium | 6.1 | 2024-11-22 | The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e… |
CVE-2024-11601 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin f… |
CVE-2024-11381 | Medium | 6.4 | 2024-11-22 | The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ch_registro' shortcode in all versions up to, and includi… |
CVE-2024-11355 | Medium | 4.3 | 2024-11-22 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-11225 | Medium | 6.1 | 2024-11-22 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with… |
CVE-2024-11104 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress i… |
CVE-2024-10666 | Medium | 4.3 | 2024-11-22 | The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via… |
CVE-2024-10034 | Medium | 5.5 | 2024-11-22 | The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerabl… |
CVE-2024-38296 | Medium | 6.7 | 2024-11-22 | Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in… |
CVE-2024-47142 | Medium | 5.5 | 2024-11-22 | AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials… |
CVE-2024-45837 | Medium | 5.4 | 2024-11-22 | Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may… |
CVE-2024-39290 | Medium | 6.5 | 2024-11-22 | Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticated attacker may obtain sensitive informa… |
CVE-2024-31408 | High | 8.0 | 2024-11-22 | OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command wi… |
CVE-2024-52056 | Medium | 6.5 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the ta… |
CVE-2024-52055 | Medium | 4.9 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target di… |
CVE-2024-52054 | Low | 2.7 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the fil… |
CVE-2024-52053 | Critical | 9.6 | 2024-11-21 | Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript… |
CVE-2024-52052 | High | 7.2 | 2024-11-21 | Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream… |
CVE-2024-52616 | Medium | 5.3 | 2024-11-21 | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This p… |
CVE-2024-52615 | Medium | 5.3 | 2024-11-21 | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are… |
CVE-2024-51367 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via upload… |