2024 CVEs (page 112)
Page 112 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43645 | Medium | 6.7 | 2024-11-12 | Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability |
CVE-2024-43644 | High | 7.8 | 2024-11-12 | Windows Client-Side Caching Elevation of Privilege Vulnerability |
CVE-2024-43643 | Medium | 6.8 | 2024-11-12 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
CVE-2024-43642 | High | 7.5 | 2024-11-12 | Windows SMB Denial of Service Vulnerability |
CVE-2024-43641 | High | 7.8 | 2024-11-12 | Windows Registry Elevation of Privilege Vulnerability |
CVE-2024-43640 | High | 7.8 | 2024-11-12 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
CVE-2024-43639 | Critical | 9.8 | 2024-11-12 | Windows KDC Proxy Remote Code Execution Vulnerability |
CVE-2024-43638 | Medium | 6.8 | 2024-11-12 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
CVE-2024-43637 | Medium | 6.8 | 2024-11-12 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
CVE-2024-43636 | High | 7.8 | 2024-11-12 | Win32k Elevation of Privilege Vulnerability |
CVE-2024-43635 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43634 | Medium | 6.8 | 2024-11-12 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
CVE-2024-43633 | Medium | 6.5 | 2024-11-12 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-43631 | Medium | 6.7 | 2024-11-12 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2024-43630 | High | 7.8 | 2024-11-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-43629 | High | 7.8 | 2024-11-12 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2024-43628 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43627 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43626 | High | 7.8 | 2024-11-12 | Windows Telephony Service Elevation of Privilege Vulnerability |
CVE-2024-43625 | High | 8.1 | 2024-11-12 | Microsoft Windows VMSwitch Elevation of Privilege Vulnerability |
CVE-2024-43624 | High | 8.8 | 2024-11-12 | Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability |
CVE-2024-43623 | High | 7.8 | 2024-11-12 | Windows NT OS Kernel Elevation of Privilege Vulnerability |
CVE-2024-43622 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43621 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43620 | High | 8.8 | 2024-11-12 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2024-43602 | Critical | 9.9 | 2024-11-12 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-43598 | High | 8.1 | 2024-11-12 | LightGBM Remote Code Execution Vulnerability |
CVE-2024-43530 | High | 7.8 | 2024-11-12 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-43499 | High | 7.5 | 2024-11-12 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-43498 | Critical | 9.8 | 2024-11-12 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2024-43462 | High | 8.8 | 2024-11-12 | SQL Server Native Client Remote Code Execution Vulnerability |
CVE-2024-43459 | High | 8.8 | 2024-11-12 | SQL Server Native Client Remote Code Execution Vulnerability |
CVE-2024-43452 | High | 7.5 | 2024-11-12 | Windows Registry Elevation of Privilege Vulnerability |
CVE-2024-43451 | Medium | 6.5 | 2024-11-12 | NTLM Hash Disclosure Spoofing Vulnerability |
CVE-2024-43450 | High | 7.5 | 2024-11-12 | Windows DNS Spoofing Vulnerability |
CVE-2024-43449 | Medium | 6.8 | 2024-11-12 | Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
CVE-2024-43447 | High | 8.1 | 2024-11-12 | Windows SMBv3 Server Remote Code Execution Vulnerability |
CVE-2024-38264 | Medium | 5.9 | 2024-11-12 | Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability |
CVE-2024-38255 | High | 8.8 | 2024-11-12 | SQL Server Native Client Remote Code Execution Vulnerability |
CVE-2024-38203 | Medium | 6.2 | 2024-11-12 | Windows Package Library Manager Information Disclosure Vulnerability |
CVE-2024-21976 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21975 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21974 | High | 8.8 | 2024-11-12 | Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. |
CVE-2024-21958 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resul… |
CVE-2024-21957 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resultin… |
CVE-2024-21949 | Medium | 5.5 | 2024-11-12 | Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to system crash. |
CVE-2024-21946 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resu… |
CVE-2024-21945 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potential… |
CVE-2024-21939 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escala… |
CVE-2024-21938 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an… |
CVE-2024-21937 | High | 7.3 | 2024-11-12 | Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitr… |
CVE-2024-11138 | Low | 2.7 | 2024-11-12 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. Th… |
CVE-2024-9999 | Medium | 6.5 | 2024-11-12 | In WS_FTP Server versions before 8.8.9 (2022.0.9), an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the… |
CVE-2024-9843 | Medium | 5.0 | 2024-11-12 | A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. |
CVE-2024-9842 | High | 7.3 | 2024-11-12 | Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. |
CVE-2024-8539 | High | 7.1 | 2024-11-12 | Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files. |
CVE-2024-7571 | High | 7.8 | 2024-11-12 | Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. |
CVE-2024-52010 | | 2024-11-12 | Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker t… | |
CVE-2024-51750 | Medium | 5.0 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web… |
CVE-2024-51749 | Low | 3.5 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attach… |
CVE-2024-50336 | | 2024-11-12 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via cra… | |
CVE-2024-49528 | High | 7.8 | 2024-11-12 | Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-49527 | Medium | 5.5 | 2024-11-12 | Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2024-49526 | High | 7.8 | 2024-11-12 | Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2024-49521 | High | 7.7 | 2024-11-12 | Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A lo… |
CVE-2024-49514 | High | 7.8 | 2024-11-12 | Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary cod… |
CVE-2024-49369 | Critical | 9.8 | 2024-11-12 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The… |
CVE-2024-30133 | Medium | 5.3 | 2024-11-12 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during… |
CVE-2024-11006 | Critical | 9.1 | 2024-11-12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable t… |
CVE-2024-11005 | Critical | 9.1 | 2024-11-12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable t… |
CVE-2024-11004 | Medium | 6.1 | 2024-11-12 | Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obt… |
CVE-2024-10945 | High | 7.3 | 2024-11-12 | A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor to replace certain f… |
CVE-2024-10944 | High | 8.4 | 2024-11-12 | A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input v… |
CVE-2024-10943 | Critical | 9.1 | 2024-11-12 | An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat … |
CVE-2024-10923 | | 2024-11-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ ALM Octane Management allows Stored XSS… | |
CVE-2024-9420 | High | 8.8 | 2024-11-12 | A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-8495 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated at… |
CVE-2024-52297 | Critical | 9.8 | 2024-11-12 | Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users… |
CVE-2024-52296 | Medium | 6.5 | 2024-11-12 | libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. At ospd_… |
CVE-2024-50331 | High | 7.5 | 2024-11-12 | An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory. |
CVE-2024-50330 | Critical | 9.8 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to… |
CVE-2024-50329 | High | 8.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to… |
CVE-2024-50328 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50327 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50326 | High | 7.2 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50324 | High | 7.2 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-50323 | High | 7.8 | 2024-11-12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to a… |
CVE-2024-50322 | High | 7.8 | 2024-11-12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-50321 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50320 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50319 | High | 7.5 | 2024-11-12 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50318 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-50317 | High | 7.5 | 2024-11-12 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-47909 | Medium | 4.9 | 2024-11-12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated a… |
CVE-2024-47907 | High | 7.5 | 2024-11-12 | A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-47906 | High | 7.8 | 2024-11-12 | Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Ap… |
CVE-2024-47905 | Medium | 4.9 | 2024-11-12 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated a… |
CVE-2024-47535 | Medium | 5.5 | 2024-11-12 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsaf… |
CVE-2024-43415 | Critical | 9.0 | 2024-11-12 | An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allow… |
CVE-2024-11007 | Critical | 9.1 | 2024-11-12 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable t… |