2024 CVEs (page 109)
Page 109 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29085 | Medium | 5.5 | 2024-11-13 | Improper access control for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable escalation of… |
CVE-2024-29083 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable esc… |
CVE-2024-29079 | Medium | 6.8 | 2024-11-13 | Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially enable escalation… |
CVE-2024-29077 | Medium | 6.7 | 2024-11-13 | Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-29076 | Medium | 5.5 | 2024-11-13 | Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of service via local ac… |
CVE-2024-28952 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially enable escalation o… |
CVE-2024-28950 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated user to potentially… |
CVE-2024-28885 | Medium | 5.9 | 2024-11-13 | Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. |
CVE-2024-28881 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potentially enable escal… |
CVE-2024-28169 | Medium | 5.4 | 2024-11-13 | Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentia… |
CVE-2024-28051 | Low | 2.2 | 2024-11-13 | Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disclosure via local a… |
CVE-2024-28049 | Medium | 5.7 | 2024-11-13 | Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow… |
CVE-2024-28030 | Low | 2.2 | 2024-11-13 | NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2024-28028 | High | 7.5 | 2024-11-13 | Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of… |
CVE-2024-27200 | Medium | 4.4 | 2024-11-13 | Improper access control in some Intel(R) Granulate(TM) software before version 4.30.1 may allow a authenticated user to potentially enable escalation of privil… |
CVE-2024-26017 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated user to potentially enable escalation o… |
CVE-2024-25647 | Medium | 6.7 | 2024-11-13 | Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentia… |
CVE-2024-25565 | Low | 3.8 | 2024-11-13 | Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial of service via loca… |
CVE-2024-25563 | Low | 3.4 | 2024-11-13 | Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user t… |
CVE-2024-24985 | High | 7.2 | 2024-11-13 | Exposure of resource to wrong sphere in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege v… |
CVE-2024-24984 | Medium | 6.5 | 2024-11-13 | Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated user to potentially en… |
CVE-2024-23919 | Medium | 5.3 | 2024-11-13 | Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-23918 | High | 8.8 | 2024-11-13 | Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentiall… |
CVE-2024-23312 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially e… |
CVE-2024-23198 | Medium | 6.6 | 2024-11-13 | Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unaut… |
CVE-2024-22185 | High | 7.2 | 2024-11-13 | Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privile… |
CVE-2024-21853 | Medium | 4.7 | 2024-11-13 | Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentia… |
CVE-2024-21850 | Medium | 6.0 | 2024-11-13 | Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow a privileged user to… |
CVE-2024-21820 | High | 7.2 | 2024-11-13 | Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potent… |
CVE-2024-21808 | Medium | 4.2 | 2024-11-13 | Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-21799 | High | 7.1 | 2024-11-13 | Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2024-21783 | Medium | 4.8 | 2024-11-13 | Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-11193 | Medium | 6.5 | 2024-11-13 | An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw res… |
CVE-2024-42834 | Medium | 5.4 | 2024-11-13 | A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attack… |
CVE-2024-40443 | Medium | 4.3 | 2024-11-13 | SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the dele… |
CVE-2024-49379 | | 2024-11-13 | Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerabili… | |
CVE-2024-43093 | High | 7.3 | 2024-11-13 | In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due… |
CVE-2024-43091 | Critical | 9.8 | 2024-11-13 | In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no a… |
CVE-2024-43090 | Medium | 5.0 | 2024-11-13 | In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User e… |
CVE-2024-43089 | High | 7.8 | 2024-11-13 | In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalat… |
CVE-2024-43088 | High | 7.8 | 2024-11-13 | In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missi… |
CVE-2024-43087 | High | 7.8 | 2024-11-13 | In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility se… |
CVE-2024-43086 | Medium | 5.5 | 2024-11-13 | In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. T… |
CVE-2024-43085 | High | 7.8 | 2024-11-13 | In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in t… |
CVE-2024-43084 | Medium | 5.5 | 2024-11-13 | In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no ad… |
CVE-2024-43083 | Medium | 5.5 | 2024-11-13 | In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-43082 | Medium | 5.5 | 2024-11-13 | In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information d… |
CVE-2024-43081 | High | 7.8 | 2024-11-13 | In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead… |
CVE-2024-43080 | High | 7.8 | 2024-11-13 | In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of… |
CVE-2024-40671 | High | 7.8 | 2024-11-13 | In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead… |
CVE-2024-40661 | High | 7.8 | 2024-11-13 | In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This co… |
CVE-2024-40660 | High | 7.8 | 2024-11-13 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead… |
CVE-2024-34747 | High | 7.8 | 2024-11-13 | In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privil… |
CVE-2024-34729 | High | 7.8 | 2024-11-13 | In multiple locations, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the k… |
CVE-2024-34719 | High | 7.8 | 2024-11-13 | In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional… |
CVE-2024-31337 | High | 7.8 | 2024-11-13 | In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of priv… |
CVE-2024-23715 | High | 7.8 | 2024-11-13 | In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege in t… |
CVE-2024-9476 | | 2024-11-13 | A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within… | |
CVE-2024-9413 | High | 8.0 | 2024-11-13 | The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Proc… |
CVE-2024-52292 | High | 7.7 | 2024-11-13 | Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This f… |
CVE-2024-52291 | High | 8.4 | 2024-11-13 | Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file://… |
CVE-2024-51996 | High | 7.5 | 2024-11-13 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony do… |
CVE-2024-45594 | High | 7.7 | 2024-11-13 | Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a m… |
CVE-2024-8049 | Medium | 6.5 | 2024-11-13 | In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessiv… |
CVE-2024-7295 | High | 7.1 | 2024-11-13 | In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a soph… |
CVE-2024-52306 | High | 7.6 | 2024-11-13 | FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to… |
CVE-2024-52305 | Medium | 6.5 | 2024-11-13 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowin… |
CVE-2024-52300 | Critical | 9.0 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any… |
CVE-2024-52299 | High | 7.5 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in th… |
CVE-2024-52298 | High | 7.5 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my vie… |
CVE-2024-52295 | Critical | 9.8 | 2024-11-13 | DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is… |
CVE-2024-52293 | High | 7.2 | 2024-11-13 | Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Re… |
CVE-2024-50972 | High | 7.2 | 2024-11-13 | A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via… |
CVE-2024-50971 | High | 7.2 | 2024-11-13 | A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the… |
CVE-2024-50970 | High | 8.8 | 2024-11-13 | A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands… |
CVE-2024-50969 | Medium | 6.1 | 2024-11-13 | A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts o… |
CVE-2024-11175 | Low | 3.5 | 2024-11-13 | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of… |
CVE-2024-10013 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerabil… |
CVE-2024-10012 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-9477 | Medium | 6.1 | 2024-11-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripti… |
CVE-2024-50854 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function. |
CVE-2024-50853 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function. |
CVE-2024-50852 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function. |
CVE-2024-49506 | | 2024-11-13 | Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a f… | |
CVE-2024-49505 | Medium | 6.1 | 2024-11-13 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of… |
CVE-2024-49504 | | 2024-11-13 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. | |
CVE-2024-48900 | Medium | 4.3 | 2024-11-13 | A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those the… |
CVE-2024-48510 | Critical | 9.8 | 2024-11-13 | Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.c… |
CVE-2024-11165 | | 2024-11-13 | An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversi… | |
CVE-2024-48989 | High | 7.5 | 2024-11-13 | A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, renderi… |
CVE-2024-11159 | Medium | 4.3 | 2024-11-13 | Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird <… |
CVE-2024-47574 | High | 7.8 | 2024-11-13 | A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through… |
CVE-2024-4741 | High | 7.5 | 2024-11-13 | Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary… |
CVE-2024-8001 | Medium | 5.3 | 2024-11-13 | A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulati… |
CVE-2024-11028 | Critical | 9.8 | 2024-11-13 | The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including… |
CVE-2024-9682 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions… |
CVE-2024-9668 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up… |
CVE-2024-9059 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, an… |
CVE-2024-10877 | Medium | 6.1 | 2024-11-13 | The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_ar… |
CVE-2024-52268 | Medium | 4.8 | 2024-11-13 | Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script… |