2024 CVEs (page 103)
Page 103 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10103 | Medium | 6.1 | 2024-11-19 | In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the edito… |
CVE-2024-21539 | High | 7.5 | 2024-11-19 | Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An a… |
CVE-2024-50302 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds… |
CVE-2024-50301 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of boun… |
CVE-2024-50300 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitia… |
CVE-2024-50299 | High | 8.2 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to tha… |
CVE-2024-50298 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous implementation, vf_state i… |
CVE-2024-50297 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets i… |
CVE-2024-50296 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and t… |
CVE-2024-50295 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and pdev->dev… |
CVE-2024-50294 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kaf… |
CVE-2024-50293 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in __smc_create() Thanks to commit 4bbd360a50… |
CVE-2024-50292 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error wh… |
CVE-2024-50291 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: add missing buffer index check dvb_vb2_expbuf() didn't check if the give… |
CVE-2024-50290 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR… |
CVE-2024-50289 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: av7110: fix a spectre vulnerability As warned by smatch: drivers/staging/media/av… |
CVE-2024-50288 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers… |
CVE-2024-50287 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logi… |
CVE-2024-50286 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition bet… |
CVE-2024-50285 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB oper… |
CVE-2024-50284 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL… |
CVE-2024-50283 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be… |
CVE-2024-50282 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buff… |
CVE-2024-50281 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unseali… |
CVE-2024-50280 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_O… |
CVE-2024-50279 | High | 7.1 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the… |
CVE-2024-50278 | High | 7.1 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds access occ… |
CVE-2024-50277 | Medium | 4.7 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blk_alloc_disk fails If blk_alloc_disk fails, the variable md->disk is… |
CVE-2024-50276 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wi… |
CVE-2024-50275 | High | 7.3 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE tra… |
CVE-2024-50274 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpf_get_link_ksettings When the device control plane is remo… |
CVE-2024-50273 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_re… |
CVE-2024-50272 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemap_read() If the caller supplies an iocb->ki_pos val… |
CVE-2024-50271 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: signal: restore the override_rlimit logic Prior to commit d64696905554 ("Reimplement RLIM… |
CVE-2024-50270 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feed_loop_next_input(… |
CVE-2024-50269 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: musb: sunx… |
CVE-2024-50268 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" v… |
CVE-2024-50267 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev… |
CVE-2024-50266 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs A recent change in the ve… |
CVE-2024-50265 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller i… |
CVE-2024-50264 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopb… |
CVE-2024-52340 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MartyThornley Photographer Connections photographer-conne… |
CVE-2024-52339 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows S… |
CVE-2024-51940 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sohelwpexpert WP Responsive Video my-wp-responsive-video… |
CVE-2024-51939 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Santhosh veer Stylish Internal Links stylish-internal-lin… |
CVE-2024-33231 | Medium | 5.4 | 2024-11-18 | Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to the PDF preview compo… |
CVE-2024-52587 | High | 8.8 | 2024-11-18 | StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden… |
CVE-2024-52418 | High | 7.1 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CactusThemes Gameplan gameplan allows Reflected XSS.This… |
CVE-2024-52417 | High | 7.1 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected… |
CVE-2024-52394 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedi… |
CVE-2024-52390 | Medium | 4.9 | 2024-11-18 | Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3. |
CVE-2024-52389 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Stored XSS… |
CVE-2024-52349 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip al… |
CVE-2024-52348 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Extensions AA Audio Player aa-audio-player allows DOM-… |
CVE-2024-52347 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPFo… |
CVE-2024-52346 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS… |
CVE-2024-52345 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This… |
CVE-2024-52344 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signa… |
CVE-2024-52343 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing… |
CVE-2024-52342 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allo… |
CVE-2024-52341 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allo… |
CVE-2024-51051 | Critical | 9.8 | 2024-11-18 | AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account. |
CVE-2024-21287 | High | 7.5 | 2024-11-18 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported versio… |
CVE-2024-10486 | Medium | 5.3 | 2024-11-18 | The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly ac… |
CVE-2024-52585 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can aff… |
CVE-2024-52584 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit t… |
CVE-2024-52583 | High | 8.2 | 2024-11-18 | The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` be… |
CVE-2024-52506 | Medium | 6.5 | 2024-11-18 | Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboar… |
CVE-2024-52304 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions… |
CVE-2024-51053 | Critical | 9.8 | 2024-11-18 | An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-50849 | Medium | 4.8 | 2024-11-18 | A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitra… |
CVE-2024-50848 | Medium | 6.5 | 2024-11-18 | An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive inform… |
CVE-2024-50804 | High | 7.8 | 2024-11-18 | Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via the Device_DeviceI… |
CVE-2024-52303 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur… |
CVE-2024-51743 | High | 8.8 | 2024-11-18 | MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the upd… |
CVE-2024-51499 | High | 8.8 | 2024-11-18 | MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible… |
CVE-2024-50919 | Critical | 9.8 | 2024-11-18 | Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary c… |
CVE-2024-48917 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However… |
CVE-2024-48294 | Medium | 5.5 | 2024-11-18 | A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Service (DoS) via a craf… |
CVE-2024-48293 | Medium | 6.5 | 2024-11-18 | Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbitrarily modify antiv… |
CVE-2024-48292 | High | 8.8 | 2024-11-18 | An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate priv… |
CVE-2024-47873 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, pr… |
CVE-2024-47820 | Medium | 5.7 | 2024-11-18 | MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated inst… |
CVE-2024-47533 | Critical | 9.8 | 2024-11-18 | Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in… |
CVE-2024-44757 | High | 7.5 | 2024-11-18 | An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitra… |
CVE-2024-44756 | Critical | 9.8 | 2024-11-18 | NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin. |
CVE-2024-43416 | High | 7.5 | 2024-11-18 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application… |
CVE-2024-10390 | Medium | 6.4 | 2024-11-18 | The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences'… |
CVE-2024-9474 | High | 7.2 | 2024-11-18 | A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform… |
CVE-2024-52574 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52573 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52572 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52571 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52570 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52569 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52568 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52567 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52566 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52565 | High | 7.8 | 2024-11-18 | A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12)… |
CVE-2024-52426 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue a… |