2024 CVEs (page 118)
Page 118 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50200 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: maple_tree: correct tree corruption on spanning store Patch series "maple_tree: correct t… |
CVE-2024-50199 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a 1GB HugeTL… |
CVE-2024-50198 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that… |
CVE-2024-50197 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: intel: platform: fix error path in device_for_each_child_node() The device_for_e… |
CVE-2024-50196 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: ocelot: fix system hang on level based interrupts The current implementation onl… |
CVE-2024-50195 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew pointed out, it… |
CVE-2024-50194 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is broken for bi… |
CVE-2024-50193 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffers are curr… |
CVE-2024-50192 | Medium | 4.7 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a… |
CVE-2024-50191 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ext4: don't set SB_RDONLY after filesystem errors When the filesystem is mounted with err… |
CVE-2024-50190 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Make ice_c… |
CVE-2024-50189 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() Using the device-managed ver… |
CVE-2024-50188 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber p… |
CVE-2024-50187 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor… |
CVE-2024-50186 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the… |
CVE-2024-50185 | High | 8.2 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted D… |
CVE-2024-50184 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: Check device status before requesting flush If a pmem device is in a bad sta… |
CVE-2024-50183 | Medium | 4.7 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an… |
CVE-2024-50182 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if arch cannot set direct map Return -ENOSYS from memfd… |
CVE-2024-50180 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are pla… |
CVE-2024-50179 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-i… |
CVE-2024-50178 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request() Use raw_smp_proces… |
CVE-2024-50177 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since curso… |
CVE-2024-50176 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix error handling when power-up failed By simply bailing out, the dri… |
CVE-2024-50175 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: Remove use_count guard in stop_streaming The use_count check was intr… |
CVE-2024-50174 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race when converting group handle to group object XArray provides it's o… |
CVE-2024-50173 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup() The group variabl… |
CVE-2024-10994 | Medium | 6.3 | 2024-11-08 | A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-10993 | Medium | 6.3 | 2024-11-08 | A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /m… |
CVE-2024-10621 | Medium | 6.4 | 2024-11-08 | The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to… |
CVE-2024-21538 | High | 7.5 | 2024-11-08 | Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper in… |
CVE-2024-10991 | High | 7.3 | 2024-11-08 | A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of th… |
CVE-2024-10990 | Medium | 6.3 | 2024-11-08 | A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-10989 | Medium | 6.3 | 2024-11-08 | A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /Admin/detail.php. Th… |
CVE-2024-10988 | High | 7.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-10987 | Medium | 6.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-48011 | Low | 3.1 | 2024-11-08 | Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attack… |
CVE-2024-48010 | Medium | 6.5 | 2024-11-08 | Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability. A remote high privileged attacke… |
CVE-2024-45759 | Medium | 6.8 | 2024-11-08 | Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low pr… |
CVE-2024-8424 | High | 7.8 | 2024-11-08 | Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with S… |
CVE-2024-51998 | High | 8.6 | 2024-11-08 | changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being a… |
CVE-2024-51987 | Medium | 5.4 | 2024-11-08 | Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAcces… |
CVE-2024-47072 | High | 7.5 | 2024-11-08 | XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stac… |
CVE-2024-8810 | Medium | 6.5 | 2024-11-07 | A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attack… |
CVE-2024-51434 | Medium | 6.1 | 2024-11-07 | Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier. |
CVE-2024-50766 | Critical | 9.8 | 2024-11-07 | SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter. |
CVE-2024-49524 | Medium | 5.4 | 2024-11-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacke… |
CVE-2024-49523 | Medium | 5.4 | 2024-11-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-46961 | High | 8.1 | 2024-11-07 | The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary Jav… |
CVE-2024-46960 | High | 8.8 | 2024-11-07 | The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-36064 | Medium | 6.2 | 2024-11-07 | The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (with no permissions)… |
CVE-2024-36063 | High | 7.5 | 2024-11-07 | The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place phone calls withou… |
CVE-2024-36062 | Medium | 4.0 | 2024-11-07 | The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place… |
CVE-2024-10824 | Medium | 6.5 | 2024-11-07 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning a… |
CVE-2024-50599 | Medium | 6.1 | 2024-11-07 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endp… |
CVE-2024-10975 | High | 7.7 | 2024-11-07 | Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container S… |
CVE-2024-10007 | Critical | 9.1 | 2024-11-07 | A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via gh… |
CVE-2024-10969 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-10968 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-51995 | High | 7.1 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This… |
CVE-2024-51994 | Medium | 5.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cr… |
CVE-2024-51993 | Low | 3.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. Th… |
CVE-2024-51989 | High | 7.1 | 2024-11-07 | Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in t… |
CVE-2024-51758 | | 2024-11-07 | Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesy… | |
CVE-2024-51428 | High | 7.5 | 2024-11-07 | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. |
CVE-2024-48290 | Medium | 4.3 | 2024-11-07 | An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2024-47073 | Critical | 9.1 | 2024-11-07 | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions… |
CVE-2024-45794 | High | 8.3 | 2024-11-07 | devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and expl… |
CVE-2024-10967 | High | 7.3 | 2024-11-07 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file /Doctor/de… |
CVE-2024-10966 | Medium | 6.3 | 2024-11-07 | A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality… |
CVE-2024-48954 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. |
CVE-2024-48953 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization c… |
CVE-2024-48952 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authenti… |
CVE-2024-48951 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery (SSRF) on SOAR can be used to leak Logpoint's API Token leading to authentication… |
CVE-2024-48950 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF… |
CVE-2024-40715 | High | 7.7 | 2024-11-07 | A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must b… |
CVE-2024-10965 | Medium | 4.3 | 2024-11-07 | A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2… |
CVE-2024-10964 | Medium | 6.3 | 2024-11-07 | A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the… |
CVE-2024-8378 | Medium | 4.8 | 2024-11-07 | The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that us… |
CVE-2024-10963 | High | 7.4 | 2024-11-07 | A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick… |
CVE-2024-10668 | High | 7.5 | 2024-11-07 | There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the… |
CVE-2024-9926 | Medium | 4.3 | 2024-11-07 | The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbit… |
CVE-2024-43440 | High | 7.5 | 2024-11-07 | A flaw was found in moodle. A local file may include risks when restoring block backups. |
CVE-2024-43438 | High | 7.5 | 2024-11-07 | A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned… |
CVE-2024-43436 | High | 7.2 | 2024-11-07 | A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. |
CVE-2024-43434 | High | 8.1 | 2024-11-07 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. |
CVE-2024-43431 | High | 7.5 | 2024-11-07 | A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access. |
CVE-2024-43428 | High | 7.7 | 2024-11-07 | To address a cache poisoning risk in Moodle, additional validation for local storage was required. |
CVE-2024-43426 | High | 7.5 | 2024-11-07 | A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such… |
CVE-2024-43425 | High | 8.1 | 2024-11-07 | A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the ca… |
CVE-2024-8442 | Medium | 6.4 | 2024-11-07 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-24914 | High | 8.0 | 2024-11-07 | Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is ava… |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2024-50172 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_… |
CVE-2024-50171 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net: systemport: fix potential memory leak in bcm_sysport_xmit() The bcm_sysport_xmit() r… |
CVE-2024-50170 | High | 7.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix potential memory leak in bcmasp_xmit() The bcmasp_xmit() returns NETDEV_… |
CVE-2024-50169 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: vsock: Update rx_bytes on read_skb() Make sure virtio_transport_inc_rx_pkt() and virtio_t… |
CVE-2024-50168 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() The sun3_82586_send… |
CVE-2024-50167 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in be_xmit() The be_xmit() returns NETDEV_TX_OK without… |