2024 CVEs (page 120)
Page 120 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20504 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Ap… |
CVE-2024-20487 | Medium | 4.3 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user… |
CVE-2024-20484 | High | 7.5 | 2024-11-06 | A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacke… |
CVE-2024-20476 | Medium | 4.3 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for spe… |
CVE-2024-20457 | Medium | 6.5 | 2024-11-06 | A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated… |
CVE-2024-20445 | Medium | 5.3 | 2024-11-06 | A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated… |
CVE-2024-20418 | Critical | 10.0 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Po… |
CVE-2024-20371 | Medium | 5.3 | 2024-11-06 | A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic tha… |
CVE-2024-10827 | High | 8.8 | 2024-11-06 | Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2024-10826 | High | 8.8 | 2024-11-06 | Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2024-10318 | Medium | 5.4 | 2024-11-06 | A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an… |
CVE-2024-10920 | Low | 3.1 | 2024-11-06 | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal… |
CVE-2024-10919 | Medium | 6.3 | 2024-11-06 | A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov… |
CVE-2024-6861 | High | 7.5 | 2024-11-06 | A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to r… |
CVE-2024-35146 | Medium | 5.4 | 2024-11-06 | IBM Maximo Application Suite - Monitor Component 8.10.11, 8.11.8, and 9.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… |
CVE-2024-10916 | Medium | 5.3 | 2024-11-06 | A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows… |
CVE-2024-10081 | Critical | 10.0 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the A… |
CVE-2024-10915 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the funct… |
CVE-2024-10914 | High | 8.1 | 2024-11-06 | A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability i… |
CVE-2024-10186 | Medium | 6.4 | 2024-11-06 | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5… |
CVE-2024-8323 | Medium | 6.4 | 2024-11-06 | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in a… |
CVE-2024-10168 | Medium | 6.4 | 2024-11-06 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-10715 | Medium | 6.4 | 2024-11-06 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and includi… |
CVE-2024-9902 | Medium | 6.3 | 2024-11-06 | A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system… |
CVE-2024-8615 | Critical | 10.0 | 2024-11-06 | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_exce… |
CVE-2024-8614 | Critical | 9.9 | 2024-11-06 | The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload()… |
CVE-2024-9681 | Medium | 6.5 | 2024-11-06 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise int… |
CVE-2024-52043 | Medium | 5.3 | 2024-11-06 | Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects… |
CVE-2024-9946 | High | 8.1 | 2024-11-06 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to… |
CVE-2024-9307 | Critical | 9.9 | 2024-11-06 | The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it… |
CVE-2024-6626 | Medium | 5.3 | 2024-11-06 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi… |
CVE-2024-10543 | Medium | 4.3 | 2024-11-06 | The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent… |
CVE-2024-10535 | Medium | 5.3 | 2024-11-06 | The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unuse… |
CVE-2024-10020 | High | 8.1 | 2024-11-06 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to ins… |
CVE-2024-9934 | Medium | 6.1 | 2024-11-06 | The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cros… |
CVE-2024-7879 | Medium | 4.8 | 2024-11-06 | The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perfor… |
CVE-2024-49409 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory… |
CVE-2024-49408 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privileg… |
CVE-2024-49407 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. |
CVE-2024-49406 | Medium | 6.7 | 2024-11-06 | Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is req… |
CVE-2024-49405 | Medium | 5.3 | 2024-11-06 | Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific sc… |
CVE-2024-49404 | Medium | 5.5 | 2024-11-06 | Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical… |
CVE-2024-49403 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen. |
CVE-2024-49402 | Medium | 4.6 | 2024-11-06 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles. |
CVE-2024-49401 | Medium | 5.1 | 2024-11-06 | Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34682 | Low | 2.4 | 2024-11-06 | Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode. |
CVE-2024-34681 | Medium | 6.6 | 2024-11-06 | Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of service on Galaxy Watch. |
CVE-2024-34680 | Medium | 4.0 | 2024-11-06 | Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-34678 | Medium | 5.9 | 2024-11-06 | Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34677 | Medium | 4.0 | 2024-11-06 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
CVE-2024-34676 | Medium | 4.4 | 2024-11-06 | Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. User inte… |
CVE-2024-34675 | Low | 2.4 | 2024-11-06 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen. |
CVE-2024-34674 | Medium | 4.6 | 2024-11-06 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2024-34673 | Medium | 4.1 | 2024-11-06 | Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service. |
CVE-2024-10647 | Medium | 6.1 | 2024-11-06 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove… |
CVE-2024-10028 | High | 7.5 | 2024-11-06 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2024-51358 | Critical | 9.8 | 2024-11-05 | An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application. |
CVE-2024-51115 | Critical | 9.8 | 2024-11-05 | DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. |
CVE-2024-48746 | Critical | 9.8 | 2024-11-05 | An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component |
CVE-2024-48176 | Critical | 9.8 | 2024-11-05 | Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshe… |
CVE-2024-47464 | Medium | 6.8 | 2024-11-05 | An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbi… |
CVE-2024-47463 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47462 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47461 | High | 7.2 | 2024-11-05 | An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability… |
CVE-2024-47460 | Critical | 9.0 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-42509 | Critical | 9.8 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-51756 | | 2024-11-05 | The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code. cap-std's filesys… | |
CVE-2024-51745 | Critical | 10.0 | 2024-11-05 | Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such a… |
CVE-2024-51116 | High | 8.8 | 2024-11-05 | Tenda AC6 v2.0 V15.03.06.50 was discovered to contain a buffer overflow in the function 'formSetPPTPServer'. |
CVE-2024-10084 | Medium | 4.3 | 2024-11-05 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via th… |
CVE-2024-7995 | High | 7.8 | 2024-11-05 | A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized… |
CVE-2024-51753 | | 2024-11-05 | The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions ref… | |
CVE-2024-51752 | Medium | 5.5 | 2024-11-05 | The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions… |
CVE-2024-51746 | | 2024-11-05 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online… | |
CVE-2024-51740 | Medium | 4.3 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low priv… |
CVE-2024-51735 | | 2024-11-05 | Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allo… | |
CVE-2024-51493 | Medium | 5.3 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows a… |
CVE-2024-51382 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can resul… |
CVE-2024-51381 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin… |
CVE-2024-51380 | High | 8.4 | 2024-11-05 | Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaSc… |
CVE-2024-51379 | High | 8.4 | 2024-11-05 | Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where a… |
CVE-2024-51240 | High | 8.0 | 2024-11-05 | An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed b… |
CVE-2024-50335 | Medium | 4.9 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile pa… |
CVE-2024-50333 | Medium | 6.6 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the fil… |
CVE-2024-50332 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL… |
CVE-2024-49774 | High | 7.2 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods… |
CVE-2024-49773 | Medium | 5.3 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated… |
CVE-2024-49772 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation al… |
CVE-2024-49377 | Medium | 5.5 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities… |
CVE-2024-0134 | Medium | 4.1 | 2024-11-05 | NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of u… |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2024-50138 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a t… |
CVE-2024-50137 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will… |
CVE-2024-50136 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and… |
CVE-2024-50135 | Medium | 4.7 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modi… |
CVE-2024-50134 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace… |
CVE-2024-50133 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO ma… |
CVE-2024-50132 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a trace_probe we would se… |