2024 CVEs (page 119)
Page 119 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50166 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix refcount handling of fman-related devices In mac_probe() there are multiple… |
CVE-2024-50165 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param->string when parsing mount options In bpf_parse_param(), keep the val… |
CVE-2024-50164 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an issue in the BPF verifier… |
CVE-2024-50163 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info i… |
CVE-2024-50162 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect rxq contains a pointer to the device from where t… |
CVE-2024-50161 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check the remaining info_cnt before repeating btf fields When trying to repeat the b… |
CVE-2024-50160 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If snd_hda_gen_add_kctl fails to allocate… |
CVE-2024-50159 | High | 7.0 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() Clang static check… |
CVE-2024-50158 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix out of bound check Driver exports pacing stats only on GenP5 and P7 ada… |
CVE-2024-50157 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Driver waits indefinitely f… |
CVE-2024-50156 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() If the allocation in msm_d… |
CVE-2024-50155 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: use cond_resched() in nsim_dev_trap_report_work() I am still seeing many syzbo… |
CVE-2024-50154 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported us… |
CVE-2024-50153 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref… |
CVE-2024-50152 | Critical | 9.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) w… |
CVE-2024-50151 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enfo… |
CVE-2024-50150 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to… |
CVE-2024-50149 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job… |
CVE-2024-50148 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: K… |
CVE-2024-50147 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a dedicated bit for MAN… |
CVE-2024-50146 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't call cleanup on profile rollback failure When profile rollback fails in… |
CVE-2024-50145 | High | 7.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() build_skb() re… |
CVE-2024-50144 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put() with fence_fini() Currently we can call fence_fini() twi… |
CVE-2024-50143 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen i… |
CVE-2024-50142 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands t… |
CVE-2024-50141 | High | 7.8 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context PRMT needs to find t… |
CVE-2024-50140 | Medium | 5.5 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in task_tick_mm_cid() With KASAN and PREEMPT_RT enabl… |
CVE-2024-50139 | High | 7.9 | 2024-11-07 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN w… |
CVE-2024-10203 | High | 7.0 | 2024-11-07 | Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |
CVE-2024-30141 | Medium | 4.7 | 2024-11-07 | HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement infor… |
CVE-2024-30140 | Medium | 5.4 | 2024-11-07 | HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an attacker and as a result, it can poison the… |
CVE-2024-38286 | High | 8.6 | 2024-11-07 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from… |
CVE-2024-10027 | Medium | 4.8 | 2024-11-07 | The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such a… |
CVE-2024-10947 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System up t… |
CVE-2024-10946 | Medium | 4.7 | 2024-11-07 | A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System… |
CVE-2024-51990 | | 2024-11-07 | jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clon… | |
CVE-2024-51409 | Medium | 6.5 | 2024-11-06 | Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed format to a router ru… |
CVE-2024-48325 | High | 8.1 | 2024-11-06 | Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id"… |
CVE-2024-10928 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-10927 | Low | 3.5 | 2024-11-06 | A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php… |
CVE-2024-51736 | Unrated | | 2024-11-06 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is lo… |
CVE-2024-50345 | Low | 3.1 | 2024-11-06 | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does… |
CVE-2024-50343 | Low | 3.1 | 2024-11-06 | symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a r… |
CVE-2024-50342 | Low | 3.1 | 2024-11-06 | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When us… |
CVE-2024-50341 | Low | 3.1 | 2024-11-06 | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack fra… |
CVE-2024-50340 | High | 7.3 | 2024-11-06 | symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php direc… |
CVE-2024-10941 | Medium | 6.5 | 2024-11-06 | A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126. |
CVE-2024-10926 | Low | 3.5 | 2024-11-06 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /toggle_fol… |
CVE-2024-51988 | Medium | 6.5 | 2024-11-06 | RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the `configur… |
CVE-2024-51757 | | 2024-11-06 | happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the… | |
CVE-2024-51755 | Low | 2.2 | 2024-11-06 | Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. The… |
CVE-2024-51754 | Low | 2.2 | 2024-11-06 | Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the sec… |
CVE-2024-51751 | Medium | 6.5 | 2024-11-06 | Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of… |
CVE-2024-50637 | Medium | 5.4 | 2024-11-06 | UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. This allows attackers to perform XSS via an SVG document, which… |
CVE-2024-20540 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote att… |
CVE-2024-20539 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user… |
CVE-2024-20538 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20537 | Medium | 6.5 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-20536 | High | 8.8 | 2024-11-06 | A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remot… |
CVE-2024-20534 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform… |
CVE-2024-20533 | Medium | 4.8 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform… |
CVE-2024-20532 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20531 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected… |
CVE-2024-20530 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20529 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20528 | Low | 3.8 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to upload files to arbitrary locations on the underlying operating system… |
CVE-2024-20527 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this… |
CVE-2024-20525 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of t… |
CVE-2024-20514 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2024-20511 | Medium | 6.1 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2024-20507 | Medium | 4.3 | 2024-11-06 | A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text… |
CVE-2024-20504 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Ap… |
CVE-2024-20487 | Medium | 4.3 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user… |
CVE-2024-20484 | High | 7.5 | 2024-11-06 | A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacke… |
CVE-2024-20476 | Medium | 4.3 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-20457 | Medium | 6.5 | 2024-11-06 | A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated… |
CVE-2024-20445 | Medium | 5.3 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated… |
CVE-2024-20418 | Critical | 10.0 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Po… |
CVE-2024-20371 | Medium | 5.3 | 2024-11-06 | A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic tha… |
CVE-2024-10827 | High | 8.8 | 2024-11-06 | Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2024-10826 | High | 8.8 | 2024-11-06 | Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2024-10318 | Medium | 5.4 | 2024-11-06 | A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an… |
CVE-2024-10920 | Low | 3.1 | 2024-11-06 | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal… |
CVE-2024-10919 | Medium | 6.3 | 2024-11-06 | A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov… |
CVE-2024-6861 | High | 7.5 | 2024-11-06 | A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to r… |
CVE-2024-35146 | Medium | 5.4 | 2024-11-06 | IBM Maximo Application Suite - Monitor Component 8.10.11, 8.11.8, and 9.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… |
CVE-2024-10916 | Medium | 5.3 | 2024-11-06 | A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows… |
CVE-2024-10081 | Critical | 10.0 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the A… |
CVE-2024-10915 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the funct… |
CVE-2024-10914 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability i… |
CVE-2024-10186 | Medium | 6.4 | 2024-11-06 | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5… |
CVE-2024-8323 | Medium | 6.4 | 2024-11-06 | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in a… |
CVE-2024-10168 | Medium | 6.4 | 2024-11-06 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-10715 | Medium | 6.4 | 2024-11-06 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and includi… |
CVE-2024-9902 | Medium | 6.3 | 2024-11-06 | A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system… |
CVE-2024-8615 | Critical | 10.0 | 2024-11-06 | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_exce… |
CVE-2024-8614 | Critical | 9.9 | 2024-11-06 | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload()… |
CVE-2024-9681 | Medium | 6.5 | 2024-11-06 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise int… |