2024 CVEs (page 118)
Page 118 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50593 | High | 7.8 | 2024-11-08 | An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" pass… |
CVE-2024-50591 | High | 7.8 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command inject… |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2024-50589 | High | 7.5 | 2024-11-08 | An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR)… |
CVE-2024-10325 | Medium | 6.4 | 2024-11-08 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, an… |
CVE-2024-10839 | High | 8.5 | 2024-11-08 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. |
CVE-2024-10187 | Medium | 6.4 | 2024-11-08 | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi… |
CVE-2024-50588 | Critical | 9.8 | 2024-11-08 | An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant… |
CVE-2024-24409 | High | 8.8 | 2024-11-08 | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. |
CVE-2024-11000 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10999 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd… |
CVE-2024-10998 | High | 7.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2024-10997 | Medium | 6.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2024-10996 | High | 7.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2024-10995 | High | 7.3 | 2024-11-08 | A vulnerability was found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10269 | Medium | 6.4 | 2024-11-08 | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7… |
CVE-2024-7982 | Critical | 9.6 | 2024-11-08 | The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, whic… |
CVE-2024-50211 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: udf: refactor inode_bmap() to handle error Refactor inode_bmap() to handle error since ud… |
CVE-2024-50210 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc(… |
CVE-2024-50209 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a check for memory allocation __alloc_pbl() can return error when memor… |
CVE-2024-50208 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Avoid memory corruption while… |
CVE-2024-50207 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix reader locking when changing the sub buffer order The function ring_buff… |
CVE-2024-50206 | Critical | 9.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init The loop responsible… |
CVE-2024-50205 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variabl… |
CVE-2024-50204 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: fs: don't try and remove empty rbtree node When copying a namespace we won't have added t… |
CVE-2024-50203 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG… |
CVE-2024-50202 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported that a ta… |
CVE-2024-50201 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix encoder->possible_clones Include the encoder itself in its possible_clone… |
CVE-2024-50200 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: maple_tree: correct tree corruption on spanning store Patch series "maple_tree: correct t… |
CVE-2024-50199 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a 1GB HugeTL… |
CVE-2024-50198 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev pointer that… |
CVE-2024-50197 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: intel: platform: fix error path in device_for_each_child_node() The device_for_e… |
CVE-2024-50196 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: ocelot: fix system hang on level based interrupts The current implementation onl… |
CVE-2024-50195 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew pointed out, it… |
CVE-2024-50194 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is broken for bi… |
CVE-2024-50193 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffers are curr… |
CVE-2024-50192 | Medium | 4.7 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a… |
CVE-2024-50191 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ext4: don't set SB_RDONLY after filesystem errors When the filesystem is mounted with err… |
CVE-2024-50190 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in ice_init_tx_topology() Fix leak of the FW blob (DDP pkg). Make ice_c… |
CVE-2024-50189 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() Using the device-managed ver… |
CVE-2024-50188 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber p… |
CVE-2024-50187 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor… |
CVE-2024-50186 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the… |
CVE-2024-50185 | High | 8.2 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted D… |
CVE-2024-50184 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: Check device status before requesting flush If a pmem device is in a bad sta… |
CVE-2024-50183 | Medium | 4.7 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance Deleting an… |
CVE-2024-50182 | High | 7.1 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfd_secret() if arch cannot set direct map Return -ENOSYS from memfd… |
CVE-2024-50180 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are pla… |
CVE-2024-50179 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-i… |
CVE-2024-50178 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request() Use raw_smp_proces… |
CVE-2024-50177 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since curso… |
CVE-2024-50176 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix error handling when power-up failed By simply bailing out, the dri… |
CVE-2024-50175 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: Remove use_count guard in stop_streaming The use_count check was intr… |
CVE-2024-50174 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race when converting group handle to group object XArray provides it's o… |
CVE-2024-50173 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup() The group variabl… |
CVE-2024-10994 | Medium | 6.3 | 2024-11-08 | A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-10993 | Medium | 6.3 | 2024-11-08 | A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /m… |
CVE-2024-10621 | Medium | 6.4 | 2024-11-08 | The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to… |
CVE-2024-21538 | High | 7.5 | 2024-11-08 | Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper in… |
CVE-2024-10991 | High | 7.3 | 2024-11-08 | A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of th… |
CVE-2024-10990 | Medium | 6.3 | 2024-11-08 | A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-10989 | Medium | 6.3 | 2024-11-08 | A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /Admin/detail.php. Th… |
CVE-2024-10988 | High | 7.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-10987 | Medium | 6.3 | 2024-11-08 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-48011 | Low | 3.1 | 2024-11-08 | Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attack… |
CVE-2024-48010 | Medium | 6.5 | 2024-11-08 | Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability. A remote high privileged attacke… |
CVE-2024-45759 | Medium | 6.8 | 2024-11-08 | Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low pr… |
CVE-2024-8424 | High | 7.8 | 2024-11-08 | Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with S… |
CVE-2024-51998 | High | 8.6 | 2024-11-08 | changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being a… |
CVE-2024-51987 | Medium | 5.4 | 2024-11-08 | Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAcces… |
CVE-2024-47072 | High | 7.5 | 2024-11-08 | XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stac… |
CVE-2024-8810 | Medium | 6.5 | 2024-11-07 | A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attack… |
CVE-2024-51434 | Medium | 6.1 | 2024-11-07 | Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier. |
CVE-2024-50766 | Critical | 9.8 | 2024-11-07 | SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter. |
CVE-2024-49524 | Medium | 5.4 | 2024-11-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacke… |
CVE-2024-49523 | Medium | 5.4 | 2024-11-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-46961 | High | 8.1 | 2024-11-07 | The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary Jav… |
CVE-2024-46960 | High | 8.8 | 2024-11-07 | The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-36064 | Medium | 6.2 | 2024-11-07 | The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (with no permissions)… |
CVE-2024-36063 | High | 7.5 | 2024-11-07 | The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place phone calls withou… |
CVE-2024-36062 | Medium | 4.0 | 2024-11-07 | The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no permissions) to place… |
CVE-2024-10824 | Medium | 6.5 | 2024-11-07 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning a… |
CVE-2024-50599 | Medium | 6.1 | 2024-11-07 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endp… |
CVE-2024-10975 | High | 7.7 | 2024-11-07 | Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container S… |
CVE-2024-10007 | Critical | 9.1 | 2024-11-07 | A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via gh… |
CVE-2024-10969 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-10968 | High | 7.3 | 2024-11-07 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-51995 | High | 7.1 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This… |
CVE-2024-51994 | Medium | 5.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cr… |
CVE-2024-51993 | Low | 3.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. Th… |
CVE-2024-51989 | High | 7.1 | 2024-11-07 | Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in t… |
CVE-2024-51758 | | 2024-11-07 | Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesy… | |
CVE-2024-51428 | High | 7.5 | 2024-11-07 | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. |
CVE-2024-48290 | Medium | 4.3 | 2024-11-07 | An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2024-47073 | Critical | 9.1 | 2024-11-07 | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions… |
CVE-2024-45794 | High | 8.3 | 2024-11-07 | devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and expl… |
CVE-2024-10967 | High | 7.3 | 2024-11-07 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file /Doctor/de… |
CVE-2024-10966 | Medium | 6.3 | 2024-11-07 | A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality… |
CVE-2024-48954 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. |
CVE-2024-48953 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization c… |