CVE-2024-49xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

777 records · Page 7 of 8

• CVE-2024-49257: WordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.

  Updated 2026-04-28
• CVE-2024-49256: WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability 6.5 Medium

  Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.

  Updated 2026-04-28
• CVE-2024-49255: WordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Stored XSS.This issue affects Da Reactions: from n/a through <= 5.1.5.

  Updated 2026-04-28
• CVE-2024-49254: WordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerability 10.0 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2024-49253: WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability 8.6 High

  Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.

  Updated 2026-04-29
• CVE-2024-49252: WordPress leyka plugin <=3.31.6 - Broken Access Control vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through <= 3.31.6.

  Updated 2026-04-28
• CVE-2024-49251: WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-elementor-addons allows Local Code Inclusion.This issue affects Maan Addons For Elementor: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2024-49250: WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.

  Updated 2026-04-28
• CVE-2024-49249: WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability 8.6 High

  Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2024-49248: WordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through <= 2.7.37.

  Updated 2026-04-29
• CVE-2024-49247: WordPress BuddyPress Better Registration plugin <= 1.6 - Broken Authentication vulnerability 9.8 Critical

  Authentication Bypass Using an Alternate Path or Channel vulnerability in SK BuddyPress Better Registration better-bp-registration allows Authentication Bypass.This issue affects BuddyPress Better Registration: from n/a through <= 1.6.

  Updated 2026-04-29
• CVE-2024-49246: WordPress Ajax Rating with Custom Login plugin <= 1.1 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login ajax-rating-with-custom-login allows SQL Injection.This issue affects Ajax Rating with Custom Login: from n/a through <= 1.1.

  Updated 2026-05-12
• CVE-2024-49245: WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability 7.5 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.

  Updated 2026-05-11
• CVE-2024-49244: WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a through <= 1.0.0.

  Updated 2026-04-29
• CVE-2024-49243: WordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dynamic-elementor-addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through <= 1.0.0.

  Updated 2026-05-11
• CVE-2024-49242: WordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through <= 3.0.5.

  Updated 2026-04-29
• CVE-2024-49241: WordPress Tito plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Tito: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2024-49240: WordPress AB Categories Search Widget plugin <= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.

  Updated 2026-04-29
• CVE-2024-49239: WordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through <= 2.2.2.

  Updated 2026-04-29
• CVE-2024-49238: WordPress ADIF Log Search Widget plugin <= 1.0f - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through <= 1.0f.

  Updated 2026-05-11
• CVE-2024-49237: WordPress Ahmeti Wp Timeline plugin <= 5.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.

  Updated 2026-04-28
• CVE-2024-49236: WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.

  Updated 2026-04-28
• CVE-2024-49235: WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: from n/a through <= 1.10.2.

  Updated 2026-04-29
• CVE-2024-49234: WordPress Plexx Elementor Extension plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-extension allows DOM-Based XSS.This issue affects Plexx Elementor Extension: from n/a through <= 1.3.6.

  Updated 2026-04-28
• CVE-2024-49233: WordPress MAS Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allows DOM-Based XSS.This issue affects MAS Elementor: from n/a through <= 1.1.6.

  Updated 2026-05-11
• CVE-2024-49232: WordPress El mejor Cluster plugin <= 1.1.15 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.

  Updated 2026-04-28
• CVE-2024-49231: WordPress WordPress Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS.This issue affects WordPress Video: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2024-49230: WordPress Ajax Custom CSS/JS plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through <= 2.0.4.

  Updated 2026-04-29
• CVE-2024-49229: WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arifnezami Better Author Bio better-author-bio allows Reflected XSS.This issue affects Better Author Bio: from n/a through <= 2.7.10.11.

  Updated 2026-04-28
• CVE-2024-49228: WordPress bVerse Convert plugin <= 1.3.7.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored XSS.This issue affects bVerse Convert: from n/a through <= 1.3.7.1.

  Updated 2026-04-28
• CVE-2024-49227: WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.

  Updated 2026-04-29
• CVE-2024-49226: WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through <= 2.8.17.

  Updated 2026-04-29
• CVE-2024-49225: WordPress wpPricing Builder plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.

  Updated 2026-04-28
• CVE-2024-49224: WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.

  Updated 2026-04-29
• CVE-2024-49223: WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.

  Updated 2026-04-29
• CVE-2024-49222: WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2024-49221: WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.

  Updated 2026-04-29
• CVE-2024-49220: WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.

  Updated 2026-04-29
• CVE-2024-49219: WordPress RS-Members plugin <= 1.0.3 - Privilege Escalation vulnerability 8.8 High

  Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1.0.3.

  Updated 2026-05-12
• CVE-2024-49218: WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.

  Updated 2026-05-12
• CVE-2024-49217: WordPress Adding drop down roles in registration plugin <= 1.1 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Escalation.This issue affects Adding drop down roles in registration: from n/a through <= 1.1.

  Updated 2026-04-29
• CVE-2024-49216: WordPress Feed Comments Number plugin <= 0.2.1 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.

  Updated 2026-05-12
• CVE-2024-49215: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-49294. Reason: This candidate is a reservation duplicate of CVE-2023-49294. Notes: All CVE users should reference CVE-2023-49 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-49294. Reason: This candidate is a reservation duplicate of CVE-2023-49294. Notes: All CVE users should reference CVE-2023-49294 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

  Updated 2024-12-09 · Rejected record
• CVE-2024-49214: QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list 5.3 Medium

  QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.

  Updated 2024-10-29
• CVE-2024-49211: Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially explo 5.2 Medium

  Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in

  Updated 2024-10-30
• CVE-2024-49210: Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit thi 5.2 Medium

  Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the c

  Updated 2024-10-30
• CVE-2024-49209: Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker coul 6.5 Medium

  Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and upload additional system icons.

  Updated 2025-03-14
• CVE-2024-49208: Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could po 5.9 Medium

  Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons.

  Updated 2025-03-14
• CVE-2024-49203: Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended Unscored

  Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.

  Updated 2025-02-21
• CVE-2024-49202: Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6. 7.6 High

  Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0.

  Updated 2024-12-20
• CVE-2024-49201: Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level. 4.3 Medium

  Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level.

  Updated 2024-12-20
• CVE-2024-49200: An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The 6.4 Medium

  An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code e

  Updated 2025-04-16
• CVE-2024-49197: An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check i 6.5 Medium

  An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access.

  Updated 2025-05-29
• CVE-2024-49196: An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service. 7.5 High

  An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service.

  Updated 2025-05-29
• CVE-2024-49195: Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair 9.8 Critical

  Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair

  Updated 2024-11-25
• CVE-2024-49194: Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in 7.3 High

  Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achieve Remote Code Execution in the context of the driver by tricking a victim into using a crafted connec

  Updated 2025-07-02
• CVE-2024-49193: Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additi 7.5 High

  Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed e-mail messages is insufficient, and the support e-mail addresses associated with individual tickets are predictable.

  Updated 2024-10-16
• CVE-2024-49147: Microsoft Update Catalog Elevation of Privilege Vulnerability 9.3 Critical

  Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.

  Updated 2026-06-09
• CVE-2024-49142: Microsoft Access Remote Code Execution Vulnerability 7.8 High

  Microsoft Access Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49138: Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49132: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49129: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability 7.5 High

  Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

  Updated 2026-06-09
• CVE-2024-49128: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

  Updated 2026-06-09
• CVE-2024-49127: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability 8.1 High

  Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49126: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability 8.1 High

  Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49125: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High

  Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49124: Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability 8.1 High

  Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49123: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49122: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability 8.1 High

  Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49121: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability 7.5 High

  Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

  Updated 2026-06-09
• CVE-2024-49120: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49119: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49118: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability 8.1 High

  Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49117: Windows Hyper-V Remote Code Execution Vulnerability 8.8 High

  Windows Hyper-V Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49116: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49115: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49114: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 7.8 High

  Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49113: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability 7.5 High

  Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

  Updated 2026-06-09
• CVE-2024-49112: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability 9.8 Critical

  Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49111: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 6.6 Medium

  Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49110: Windows Mobile Broadband Driver Elevation of Privilege Vulnerability 6.8 Medium

  Windows Mobile Broadband Driver Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49109: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 6.6 Medium

  Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49108: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49107: WmsRepair Service Elevation of Privilege Vulnerability 7.3 High

  WmsRepair Service Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49106: Windows Remote Desktop Services Remote Code Execution Vulnerability 8.1 High

  Windows Remote Desktop Services Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49105: Remote Desktop Client Remote Code Execution Vulnerability 8.4 High

  Remote Desktop Client Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49104: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High

  Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49103: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 4.3 Medium

  Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

  Updated 2026-06-09
• CVE-2024-49102: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High

  Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49101: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 6.6 Medium

  Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49099: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 4.3 Medium

  Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

  Updated 2026-06-09
• CVE-2024-49098: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 4.3 Medium

  Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

  Updated 2026-06-09
• CVE-2024-49097: Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability 7.0 High

  Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49096: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability 7.5 High

  Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

  Updated 2026-06-09
• CVE-2024-49095: Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability 7.0 High

  Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49094: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 6.6 Medium

  Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49093: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability 8.8 High

  Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49092: Windows Mobile Broadband Driver Elevation of Privilege Vulnerability 6.8 Medium

  Windows Mobile Broadband Driver Elevation of Privilege Vulnerability

  Updated 2026-06-09
• CVE-2024-49091: Windows Domain Name Service Remote Code Execution Vulnerability 7.2 High

  Windows Domain Name Service Remote Code Execution Vulnerability

  Updated 2026-06-09
• CVE-2024-49090: Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High

  Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Updated 2026-06-09

Search a CVE ID or check dependency files →