106 CVEs tracked today. 10 Critical, 38 High, 51 Medium, 4 Low.
-
CVE-2024-56828
CRITICAL
CVSS 9.8
File Upload vulnerability in ChestnutCMS through 1.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
File Upload
Chestnutcms
-
CVE-2024-54880
CRITICAL
CVSS 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Seacms
-
CVE-2024-54879
CRITICAL
CVSS 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Seacms
-
CVE-2025-21613
CRITICAL
CVSS 9.2
go-git is a highly extensible git implementation library written in pure Go. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection
Go Git
Redhat
Suse
-
CVE-2024-55529
CRITICAL
CVSS 9.8
Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RCE
Code Injection
Z Blogphp
-
CVE-2024-53932
CRITICAL
CVSS 9.1
The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (with no permissions) to place phone. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-53931
CRITICAL
CVSS 9.1
The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phone calls without user interaction by. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-46622
CRITICAL
CVSS 9.8
An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Privilege Escalation
-
CVE-2024-20148
CRITICAL
CVSS 9.8
In wlan STA FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RCE
Memory Corruption
Buffer Overflow
Yocto
Software Development Kit
-
CVE-2024-5594
CRITICAL
CVSS 9.1
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection
Openvpn
Suse
-
CVE-2025-21620
HIGH
CVSS 7.5
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Suse
-
CVE-2025-21618
HIGH
CVSS 7.5
NiceGUI is an easy-to-use, Python-based UI framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Python
-
CVE-2025-21614
HIGH
CVSS 7.5
go-git is a highly extensible git implementation library written in pure Go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Go Git
Redhat
Suse
-
CVE-2025-21612
HIGH
CVSS 8.6
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP
XSS
-
CVE-2025-21611
HIGH
CVSS 8.8
tgstation-server is a production scale tool for BYOND server management. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Authentication Bypass
Tgstation Server
-
CVE-2024-56766
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56765
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Use After Free
IBM
Information Disclosure
Memory Corruption
Linux
-
CVE-2024-56764
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Information Disclosure
Memory Corruption
Use After Free
Linux
Linux Kernel
-
CVE-2024-56759
HIGH
CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Information Disclosure
Memory Corruption
Use After Free
Linux
Linux Kernel
-
CVE-2024-55629
HIGH
CVSS 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Information Disclosure
Suricata
Suse
-
CVE-2024-55628
HIGH
CVSS 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Information Disclosure
Suricata
Suse
-
CVE-2024-55605
HIGH
CVSS 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Suricata
Suse
-
CVE-2024-55553
HIGH
CVSS 7.5
In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Redhat
Suse
-
CVE-2024-55407
HIGH
CVSS 7.8
An issue in the DeviceloControl function of ITE Tech. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2024-55076
HIGH
CVSS 8.1
Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
CSRF
Grocy
-
CVE-2024-55074
HIGH
CVSS 8.8
The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege Escalation
XSS
Grocy
-
CVE-2024-54767
HIGH
CVSS 7.5
An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2024-53934
HIGH
CVSS 7.7
The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-48457
HIGH
CVSS 7.5
Multiple Netis WiFi router models contain an additional out-of-bounds read vulnerability similar to CVE-2024-48456, affecting the same broad range of models and firmware versions. Remote unauthenticated attackers can extract sensitive data from device memory including WiFi credentials and configuration secrets.
Buffer Overflow
Information Disclosure
-
CVE-2024-48456
HIGH
CVSS 7.5
Multiple Netis WiFi router models contain an out-of-bounds read vulnerability that allows remote unauthenticated attackers to extract sensitive information from device memory. The affected models span the WiFi 6 NX10, WiFi 11AC NC65/NC63/NC21, and WiFi MW5360 product lines across multiple firmware versions.
Buffer Overflow
Information Disclosure
-
CVE-2024-46981
HIGH
CVSS 7.0
Redis versions prior to 7.4.2, 7.2.7, and 6.2.17 contain a use-after-free vulnerability in the Lua scripting engine that allows authenticated users to achieve remote code execution. By manipulating the garbage collector through crafted Lua scripts, attackers can corrupt memory and execute arbitrary code on the Redis server.
RCE
Memory Corruption
Use After Free
Redis
Debian Linux
-
CVE-2024-45558
HIGH
CVSS 7.5
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer Overflow
Ar8035 Firmware
Csr8811 Firmware
Fastconnect 6700 Firmware
Fastconnect 6900 Firmware
-
CVE-2024-45555
HIGH
CVSS 8.4
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Msm8996au Firmware
Qam8255p Firmware
Qam8295p Firmware
-
CVE-2024-45553
HIGH
CVSS 7.8
Memory corruption can occur when process-specific maps are added to the global list. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Buffer Overflow
Memory Corruption
Use After Free
Ar8035 Firmware
Fastconnect 6200 Firmware
-
CVE-2024-45550
HIGH
CVSS 7.8
Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Sc8380xp Firmware
Wcd9380 Firmware
-
CVE-2024-45548
HIGH
CVSS 7.8
Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qcc2073 Firmware
Qcc2076 Firmware
-
CVE-2024-45547
HIGH
CVSS 7.8
Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qcc2073 Firmware
Qcc2076 Firmware
-
CVE-2024-45546
HIGH
CVSS 7.8
Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qcc2073 Firmware
Qcc2076 Firmware
-
CVE-2024-45542
HIGH
CVSS 7.8
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Stack Overflow
Buffer Overflow
Aqt1000 Firmware
Fastconnect 6200 Firmware
Fastconnect 6700 Firmware
-
CVE-2024-45541
HIGH
CVSS 7.8
Memory corruption when IOCTL call is invoked from user-space to read board data. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Aqt1000 Firmware
Fastconnect 6200 Firmware
Fastconnect 6700 Firmware
Fastconnect 6800 Firmware
-
CVE-2024-43064
HIGH
CVSS 7.5
Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. Rated high severity (CVSS 7.5). No vendor patch available.
Privilege Escalation
Qam8255p Firmware
Qam8295p Firmware
Qam8620p Firmware
Qam8650p Firmware
-
CVE-2024-21464
HIGH
CVSS 8.4
Memory corruption while processing IPA statistics, when there are no active clients registered. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Buffer Overflow
Fastconnect 6700 Firmware
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qcm4490 Firmware
-
CVE-2024-20154
HIGH
CVSS 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 39.2% and no vendor patch available.
RCE
Stack Overflow
Buffer Overflow
Lr12a
Lr13
-
CVE-2024-20153
HIGH
CVSS 7.5
In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
Yocto
Software Development Kit
Android
Google
-
CVE-2024-20150
HIGH
CVSS 7.5
In Modem, there is a possible system crash due to a logic error. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization
Denial Of Service
Lr12a
Lr13
Nr15
-
CVE-2024-20149
HIGH
CVSS 7.5
In Modem, there is a possible system crash due to improper input validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial Of Service
Lr12
Lr13
Nr15
Nr16
-
CVE-2024-20146
HIGH
CVSS 8.1
In wlan STA driver, there is a possible out of bounds write due to improper input validation. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
RCE
Memory Corruption
Buffer Overflow
Yocto
Software Development Kit
-
CVE-2024-8474
HIGH
CVSS 7.5
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
Connect
-
CVE-2025-21617
MEDIUM
CVSS 6.3
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Information Disclosure
-
CVE-2025-21616
MEDIUM
CVSS 5.4
Plane is an open-source project management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Plane
-
CVE-2025-21615
MEDIUM
CVSS 5.5
AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2025-21604
MEDIUM
CVSS 6.9
LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
File Upload
Langchain
AI / ML
-
CVE-2024-56769
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Use of Uninitialized Resource vulnerability could allow attackers to access uninitialized memory causing crashes or information disclosure.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56768
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56767
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Null Pointer Dereference
Linux
Denial Of Service
Linux Kernel
Redhat
-
CVE-2024-56763
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56761
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56760
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Linux
Linux Kernel
Redhat
Suse
-
CVE-2024-56758
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_folio() to bring a folio uptodate, we. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Null Pointer Dereference
Linux
Denial Of Service
Linux Kernel
Redhat
-
CVE-2024-56757
MEDIUM
CVSS 5.5
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Information Disclosure
Mediatek
Linux
Linux Kernel
Redhat
-
CVE-2024-55627
MEDIUM
CVSS 5.9
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Heap Overflow
Buffer Overflow
Suricata
Suse
-
CVE-2024-55408
MEDIUM
CVSS 5.1
An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass
-
CVE-2024-55075
MEDIUM
CVSS 4.3
Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Grocy
-
CVE-2024-54764
MEDIUM
CVSS 6.5
An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2024-54763
MEDIUM
CVSS 6.5
An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information Disclosure
-
CVE-2024-53936
MEDIUM
CVSS 6.3
The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone calls without user interaction by. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-53935
MEDIUM
CVSS 6.5
The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) to place phone calls without user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-53933
MEDIUM
CVSS 6.3
The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no permissions) to place phone calls without. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Google
Information Disclosure
Android
-
CVE-2024-51741
MEDIUM
CVSS 4.4
Redis is an open source, in-memory database that persists on disk. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Redis
Denial Of Service
Redhat
Suse
-
CVE-2024-51112
MEDIUM
CVSS 6.1
Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Open Redirect
XSS
Pnetlab
-
CVE-2024-51111
MEDIUM
CVSS 4.1
Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Pnetlab
-
CVE-2024-47475
MEDIUM
CVSS 5.0
Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. Rated medium severity (CVSS 5.0), this vulnerability is low attack complexity. No vendor patch available.
Dell
Denial Of Service
Powerscale Onefs
-
CVE-2024-46209
MEDIUM
CVSS 5.4
A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Redaxo
-
CVE-2024-46073
MEDIUM
CVSS 6.1
A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XSS
-
CVE-2024-45559
MEDIUM
CVSS 5.5
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Qam8255p Firmware
Qam8295p Firmware
Qam8620p Firmware
Qam8650p Firmware
-
CVE-2024-43063
MEDIUM
CVSS 6.1
information disclosure while invoking the mailbox read API. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Qam8255p Firmware
Qam8295p Firmware
Qam8650p Firmware
-
CVE-2024-35498
MEDIUM
CVSS 6.1
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XSS
Grav
-
CVE-2024-33067
MEDIUM
CVSS 6.1
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity.
Buffer Overflow
Information Disclosure
Ar8035 Firmware
C V2x 9150 Firmware
Csrb31024 Firmware
-
CVE-2024-33061
MEDIUM
CVSS 6.8
Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity.
Buffer Overflow
Information Disclosure
Qcs8550 Firmware
Sw5100 Firmware
Sw5100p Firmware
-
CVE-2024-33059
MEDIUM
CVSS 6.7
Memory corruption while processing frame command IOCTL calls. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Buffer Overflow
Memory Corruption
Use After Free
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
-
CVE-2024-33055
MEDIUM
CVSS 6.7
Memory corruption while invoking IOCTL calls to unmap the DMA buffers. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Buffer Overflow
Memory Corruption
Use After Free
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
-
CVE-2024-33041
MEDIUM
CVSS 6.7
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
Memory Corruption
Buffer Overflow
Fastconnect 6900 Firmware
Fastconnect 7800 Firmware
Qam8295p Firmware
-
CVE-2024-31914
MEDIUM
CVSS 6.4
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM
XSS
Sterling B2b Integrator
-
CVE-2024-31913
MEDIUM
CVSS 5.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM
XSS
Sterling B2b Integrator
-
CVE-2024-23366
MEDIUM
CVSS 6.6
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
Buffer Overflow
Information Disclosure
Qam8255p Firmware
Qam8295p Firmware
Qam8650p Firmware
-
CVE-2024-20152
MEDIUM
CVSS 4.4
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Denial Of Service
Yocto
Software Development Kit
Android
Openwrt
-
CVE-2024-20151
MEDIUM
CVSS 6.7
In Modem, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Nr16
Nr17
-
CVE-2024-20145
MEDIUM
CVSS 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Yocto
Rdk B
-
CVE-2024-20144
MEDIUM
CVSS 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Yocto
Rdk B
-
CVE-2024-20143
MEDIUM
CVSS 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Yocto
Rdk B
-
CVE-2024-20140
MEDIUM
CVSS 6.7
In power, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Yocto
Android
-
CVE-2024-20105
MEDIUM
CVSS 6.7
In m4u, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Memory Corruption
Buffer Overflow
Privilege Escalation
Android
Google
-
CVE-2024-13145
MEDIUM
CVSS 5.3
A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
File Upload
Authentication Bypass
Java
My Blog
-
CVE-2024-13144
MEDIUM
CVSS 5.3
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
File Upload
Authentication Bypass
Java
My Blog
-
CVE-2024-13143
MEDIUM
CVSS 5.1
A vulnerability was found in ZeroWdd studentmanager 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Java
XSS
Studentmanager
-
CVE-2024-12311
MEDIUM
CVSS 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress
SQLi
Email Subscribers Newsletters
-
CVE-2024-12302
MEDIUM
CVSS 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress
XSS
Icegram Engage
-
CVE-2024-11849
MEDIUM
CVSS 6.1
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress
XSS
Pods
-
CVE-2024-11356
MEDIUM
CVSS 6.1
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress
XSS
Tour Master
-
CVE-2024-56762
None
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
Information Disclosure
-
CVE-2024-55626
LOW
CVSS 3.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.
Buffer Overflow
Suricata
-
CVE-2024-51472
LOW
CVSS 3.1
IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
IBM
Information Disclosure
XSS
Devops Deploy
Urbancode Deploy
-
CVE-2024-48455
LOW
CVSS 2.7
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 63.5% and no vendor patch available.
Information Disclosure
-
CVE-2024-12997
None
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Information Disclosure
-
CVE-2024-12996
None
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Information Disclosure
-
CVE-2024-12970
LOW
CVSS 3.9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Command Injection.7.2. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity. No vendor patch available.
Command Injection