2024 CVEs (page 119)
Page 119 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48952 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authenti… |
CVE-2024-48951 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery (SSRF) on SOAR can be used to leak Logpoint's API Token leading to authentication… |
CVE-2024-48950 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF… |
CVE-2024-40715 | High | 7.7 | 2024-11-07 | A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must b… |
CVE-2024-10965 | Medium | 4.3 | 2024-11-07 | A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2… |
CVE-2024-10964 | Medium | 6.3 | 2024-11-07 | A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the… |
CVE-2024-8378 | Medium | 4.8 | 2024-11-07 | The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that us… |
CVE-2024-10963 | High | 7.4 | 2024-11-07 | A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick… |
CVE-2024-10668 | High | 7.5 | 2024-11-07 | There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the… |
CVE-2024-9926 | Medium | 4.3 | 2024-11-07 | The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbit… |
CVE-2024-43440 | High | 7.5 | 2024-11-07 | A flaw was found in moodle. A local file may include risks when restoring block backups. |
CVE-2024-43438 | High | 7.5 | 2024-11-07 | A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned… |
CVE-2024-43436 | High | 7.2 | 2024-11-07 | A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. |
CVE-2024-43434 | High | 8.1 | 2024-11-07 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. |
CVE-2024-43431 | High | 7.5 | 2024-11-07 | A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access. |
CVE-2024-43428 | High | 7.7 | 2024-11-07 | To address a cache poisoning risk in Moodle, additional validation for local storage was required. |
CVE-2024-43426 | High | 7.5 | 2024-11-07 | A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such… |
CVE-2024-43425 | High | 8.1 | 2024-11-07 | A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the ca… |
CVE-2024-8442 | Medium | 6.4 | 2024-11-07 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-24914 | High | 8.0 | 2024-11-07 | Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is ava… |
CVE-2024-10526 | | 2024-11-07 | Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to… | |
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2024-50172 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_… |
CVE-2024-50171 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net: systemport: fix potential memory leak in bcm_sysport_xmit() The bcm_sysport_xmit() r… |
CVE-2024-50170 | High | 7.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix potential memory leak in bcmasp_xmit() The bcmasp_xmit() returns NETDEV_… |
CVE-2024-50169 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: vsock: Update rx_bytes on read_skb() Make sure virtio_transport_inc_rx_pkt() and virtio_t… |
CVE-2024-50168 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() The sun3_82586_send… |
CVE-2024-50167 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in be_xmit() The be_xmit() returns NETDEV_TX_OK without… |
CVE-2024-50166 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix refcount handling of fman-related devices In mac_probe() there are multiple… |
CVE-2024-50165 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param->string when parsing mount options In bpf_parse_param(), keep the val… |
CVE-2024-50164 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an issue in the BPF verifier… |
CVE-2024-50163 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info i… |
CVE-2024-50162 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect rxq contains a pointer to the device from where t… |
CVE-2024-50161 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check the remaining info_cnt before repeating btf fields When trying to repeat the b… |
CVE-2024-50160 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If snd_hda_gen_add_kctl fails to allocate… |
CVE-2024-50159 | High | 7.0 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() Clang static check… |
CVE-2024-50158 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix out of bound check Driver exports pacing stats only on GenP5 and P7 ada… |
CVE-2024-50157 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Driver waits indefinitely f… |
CVE-2024-50156 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() If the allocation in msm_d… |
CVE-2024-50155 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: use cond_resched() in nsim_dev_trap_report_work() I am still seeing many syzbo… |
CVE-2024-50154 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported us… |
CVE-2024-50153 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref… |
CVE-2024-50152 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) w… |
CVE-2024-50151 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enfo… |
CVE-2024-50150 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to… |
CVE-2024-50149 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job… |
CVE-2024-50148 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: K… |
CVE-2024-50147 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a dedicated bit for MAN… |
CVE-2024-50146 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't call cleanup on profile rollback failure When profile rollback fails in… |
CVE-2024-50145 | High | 7.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() build_skb() re… |
CVE-2024-50144 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put() with fence_fini() Currently we can call fence_fini() twi… |
CVE-2024-50143 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen i… |
CVE-2024-50142 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands t… |
CVE-2024-50141 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context PRMT needs to find t… |
CVE-2024-50140 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in task_tick_mm_cid() With KASAN and PREEMPT_RT enabl… |
CVE-2024-50139 | High | 7.9 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN w… |
CVE-2024-10203 | High | 7.0 | 2024-11-07 | Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2024-38286 | High | 8.6 | 2024-11-07 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from… |
CVE-2024-10027 | Medium | 4.8 | 2024-11-07 | The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such a… |
CVE-2024-10947 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System up t… |
CVE-2024-10946 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System… |
CVE-2024-51990 | | 2024-11-07 | jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clon… | |
CVE-2024-51409 | Medium | 6.5 | 2024-11-06 | Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed format to a router ru… |
CVE-2024-48325 | High | 8.1 | 2024-11-06 | Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id"… |
CVE-2024-10928 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-10927 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php… |
CVE-2024-51736 | Unrated | | 2024-11-06 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is lo… |
CVE-2024-50345 | Low | 3.1 | 2024-11-06 | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does… |
CVE-2024-50343 | Low | 3.1 | 2024-11-06 | symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a r… |
CVE-2024-50342 | Low | 3.1 | 2024-11-06 | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When us… |
CVE-2024-50341 | Low | 3.1 | 2024-11-06 | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack fra… |
CVE-2024-50340 | High | 7.3 | 2024-11-06 | symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php direc… |
CVE-2024-10941 | Medium | 6.5 | 2024-11-06 | A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126. |
CVE-2024-10926 | Low | 3.5 | 2024-11-06 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /toggle_fol… |
CVE-2024-51988 | Medium | 6.5 | 2024-11-06 | RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configur… |
CVE-2024-51757 | | 2024-11-06 | happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the… | |
CVE-2024-51755 | Low | 2.2 | 2024-11-06 | Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. The… |
CVE-2024-51754 | Low | 2.2 | 2024-11-06 | Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the sec… |
CVE-2024-51751 | Medium | 6.5 | 2024-11-06 | Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of… |
CVE-2024-50637 | Medium | 5.4 | 2024-11-06 | UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which… |
CVE-2024-20540 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote att… |
CVE-2024-20539 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user… |
CVE-2024-20538 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20537 | Medium | 6.5 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-20536 | High | 8.8 | 2024-11-06 | A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remot… |
CVE-2024-20534 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform… |
CVE-2024-20533 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform… |
CVE-2024-20532 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20531 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected… |
CVE-2024-20530 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20529 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20528 | Low | 3.8 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system… |
CVE-2024-20527 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20525 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20514 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2024-20511 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2024-20507 | Medium | 4.3 | 2024-11-06 | A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text… |