2024 CVEs (page 108)
Page 108 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10979 | High | 8.8 | 2024-11-14 | Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. P… |
CVE-2024-10978 | Medium | 4.2 | 2024-11-14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack require… |
CVE-2024-10977 | Low | 3.1 | 2024-11-14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq… |
CVE-2024-10976 | Medium | 4.2 | 2024-11-14 | Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CV… |
CVE-2024-7730 | High | 7.4 | 2024-11-14 | A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the functio… |
CVE-2024-45670 | Medium | 5.6 | 2024-11-14 | IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user… |
CVE-2024-45642 | Medium | 5.3 | 2024-11-14 | IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI th… |
CVE-2024-45099 | Low | 3.1 | 2024-11-14 | IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI th… |
CVE-2024-3447 | Medium | 6.0 | 2024-11-14 | A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer`… |
CVE-2024-9693 | High | 8.5 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 p… |
CVE-2024-8180 | Medium | 5.4 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encodi… |
CVE-2024-10571 | Critical | 9.8 | 2024-11-14 | The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' p… |
CVE-2024-9472 | | 2024-11-14 | A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when D… | |
CVE-2024-5920 | Medium | 4.8 | 2024-11-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-5917 | Medium | 4.9 | 2024-11-14 | A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2024-50305 | High | 7.5 | 2024-11-14 | Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users… |
CVE-2024-47916 | High | 7.5 | 2024-11-14 | Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-47915 | High | 7.5 | 2024-11-14 | VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-47914 | Medium | 4.5 | 2024-11-14 | VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) |
CVE-2024-45254 | High | 7.5 | 2024-11-14 | VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-45253 | High | 7.5 | 2024-11-14 | Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-38479 | High | 7.5 | 2024-11-14 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-2551 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewal… |
CVE-2024-2550 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the Glo… |
CVE-2024-7787 | | 2024-11-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship… | |
CVE-2024-11206 | High | 7.5 | 2024-11-14 | Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information. |
CVE-2024-9186 | High | 8.6 | 2024-11-14 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and es… |
CVE-2024-10146 | Medium | 5.4 | 2024-11-14 | The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflec… |
CVE-2024-5082 | | 2024-11-14 | A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and in… | |
CVE-2024-5083 | | 2024-11-14 | A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to an… | |
CVE-2024-40410 | Medium | 4.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. |
CVE-2024-40408 | High | 7.3 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allo… |
CVE-2024-40407 | High | 7.5 | 2024-11-13 | A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified ve… |
CVE-2024-40405 | High | 8.1 | 2024-11-13 | Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request. |
CVE-2024-40404 | Critical | 9.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are… |
CVE-2024-51027 | Medium | 6.5 | 2024-11-13 | Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter. |
CVE-2024-50956 | Medium | 6.5 | 2024-11-13 | A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC_AM403-CPU1608TN 81… |
CVE-2024-50955 | High | 7.5 | 2024-11-13 | An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message. |
CVE-2024-52554 | High | 8.8 | 2024-11-13 | Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed i… |
CVE-2024-52553 | High | 8.8 | 2024-11-13 | Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. |
CVE-2024-52552 | High | 8.0 | 2024-11-13 | Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored… |
CVE-2024-52551 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a… |
CVE-2024-52550 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebu… |
CVE-2024-52549 | Medium | 4.3 | 2024-11-13 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission c… |
CVE-2024-45879 | Medium | 5.4 | 2024-11-13 | The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWKalkulation/QWKalku… |
CVE-2024-45878 | Medium | 5.4 | 2024-11-13 | The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross… |
CVE-2024-45877 | Medium | 6.5 | 2024-11-13 | baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This al… |
CVE-2024-45876 | Medium | 6.5 | 2024-11-13 | The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerabili… |
CVE-2024-45875 | Medium | 5.4 | 2024-11-13 | The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable… |
CVE-2024-41167 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privi… |
CVE-2024-40885 | Medium | 6.4 | 2024-11-13 | Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2024-39811 | Medium | 6.3 | 2024-11-13 | Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-39766 | High | 7.0 | 2024-11-13 | Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user… |
CVE-2024-39609 | High | 7.5 | 2024-11-13 | Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation of privilege via lo… |
CVE-2024-39368 | High | 8.0 | 2024-11-13 | Improper neutralization of special elements used in an SQL command ('SQL Injection') in some Intel(R) Neural Compressor software before version v3.0 may allow… |
CVE-2024-39285 | Medium | 5.3 | 2024-11-13 | Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable information disclosure via loc… |
CVE-2024-38668 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authenticated user to pote… |
CVE-2024-38665 | High | 8.4 | 2024-11-13 | Out-of-bounds write in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-38660 | Low | 3.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of… |
CVE-2024-38387 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentially enable escalati… |
CVE-2024-38383 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially… |
CVE-2024-37027 | Medium | 6.1 | 2024-11-13 | Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of… |
CVE-2024-37025 | Medium | 6.7 | 2024-11-13 | Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 may allow an authent… |
CVE-2024-37024 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to potentially enable… |
CVE-2024-36488 | High | 7.3 | 2024-11-13 | Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-36482 | High | 8.2 | 2024-11-13 | Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-36294 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-36284 | Medium | 5.5 | 2024-11-13 | Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable escalation of p… |
CVE-2024-36282 | High | 8.2 | 2024-11-13 | Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged user to potentially… |
CVE-2024-36276 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-36275 | Medium | 6.1 | 2024-11-13 | NULL pointer dereference in some Intel(R) Optane(TM) PMem Management software versions before CR_MGMT_02.00.00.4040, CR_MGMT_03.00.00.0499 may allow a authenti… |
CVE-2024-36253 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in the Intel(R) SDP Tool for Windows software all version may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2024-36245 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable esc… |
CVE-2024-36242 | High | 8.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local ac… |
CVE-2024-35245 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated user to potentially… |
CVE-2024-35201 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via… |
CVE-2024-34776 | Medium | 4.5 | 2024-11-13 | Out-of-bounds write in some Intel(R) SGX SDK software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-34170 | Medium | 6.6 | 2024-11-13 | Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-34167 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow an authenticated user to potenti… |
CVE-2024-34165 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially enable escalation of p… |
CVE-2024-34164 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-34028 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, graphics driver 31.0… |
CVE-2024-34023 | High | 8.4 | 2024-11-13 | Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-34022 | Medium | 6.7 | 2024-11-13 | Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-33624 | Medium | 4.3 | 2024-11-13 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user to potentially ena… |
CVE-2024-33617 | Medium | 5.9 | 2024-11-13 | Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. |
CVE-2024-33611 | Low | 3.4 | 2024-11-13 | Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to potentially enable de… |
CVE-2024-32667 | Low | 3.9 | 2024-11-13 | Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-32485 | Low | 3.9 | 2024-11-13 | Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to potentially enable denial of service via… |
CVE-2024-32483 | High | 8.2 | 2024-11-13 | Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-32048 | Medium | 6.5 | 2024-11-13 | Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticated user to potenti… |
CVE-2024-32044 | Medium | 6.8 | 2024-11-13 | Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated user to potentially… |
CVE-2024-31407 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before version 24.1 may all… |
CVE-2024-31158 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to potentially enable escalation of privile… |
CVE-2024-31154 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentially enable escalation of privilege via loc… |
CVE-2024-31074 | Medium | 5.9 | 2024-11-13 | Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. |