2024 CVEs (page 120)
Page 120 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52043 | Medium | 5.3 | 2024-11-06 | Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects… |
CVE-2024-9946 | High | 8.1 | 2024-11-06 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to… |
CVE-2024-9307 | Critical | 9.9 | 2024-11-06 | The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it… |
CVE-2024-6626 | Medium | 5.3 | 2024-11-06 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi… |
CVE-2024-10543 | Medium | 4.3 | 2024-11-06 | The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent… |
CVE-2024-10535 | Medium | 5.3 | 2024-11-06 | The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unuse… |
CVE-2024-10020 | High | 8.1 | 2024-11-06 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to ins… |
CVE-2024-9934 | Medium | 6.1 | 2024-11-06 | The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cros… |
CVE-2024-7879 | Medium | 4.8 | 2024-11-06 | The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perfor… |
CVE-2024-49409 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory… |
CVE-2024-49408 | Medium | 6.4 | 2024-11-06 | Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory. System privileg… |
CVE-2024-49407 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. |
CVE-2024-49406 | Medium | 6.7 | 2024-11-06 | Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is req… |
CVE-2024-49405 | Medium | 5.3 | 2024-11-06 | Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific sc… |
CVE-2024-49404 | Medium | 5.5 | 2024-11-06 | Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical… |
CVE-2024-49403 | Medium | 4.6 | 2024-11-06 | Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the lock screen. |
CVE-2024-49402 | Medium | 4.6 | 2024-11-06 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles. |
CVE-2024-49401 | Medium | 5.1 | 2024-11-06 | Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34682 | Low | 2.4 | 2024-11-06 | Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode. |
CVE-2024-34681 | Medium | 6.6 | 2024-11-06 | Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of service on Galaxy Watch. |
CVE-2024-34680 | Medium | 4.0 | 2024-11-06 | Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34679 | Medium | 4.0 | 2024-11-06 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. |
CVE-2024-34678 | Medium | 5.9 | 2024-11-06 | Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34677 | Medium | 4.0 | 2024-11-06 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
CVE-2024-34676 | Medium | 4.4 | 2024-11-06 | Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. User inte… |
CVE-2024-34675 | Low | 2.4 | 2024-11-06 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen. |
CVE-2024-34674 | Medium | 4.6 | 2024-11-06 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2024-34673 | Medium | 4.1 | 2024-11-06 | Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service. |
CVE-2024-10647 | Medium | 6.1 | 2024-11-06 | The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove… |
CVE-2024-10028 | High | 7.5 | 2024-11-06 | The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2024-51358 | Critical | 9.8 | 2024-11-05 | An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application. |
CVE-2024-51115 | Critical | 9.8 | 2024-11-05 | DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. |
CVE-2024-48746 | Critical | 9.8 | 2024-11-05 | An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component |
CVE-2024-48176 | Critical | 9.8 | 2024-11-05 | Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshe… |
CVE-2024-47464 | Medium | 6.8 | 2024-11-05 | An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbi… |
CVE-2024-47463 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47462 | High | 7.2 | 2024-11-05 | An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could all… |
CVE-2024-47461 | High | 7.2 | 2024-11-05 | An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability… |
CVE-2024-47460 | Critical | 9.0 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-42509 | Critical | 9.8 | 2024-11-05 | Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined… |
CVE-2024-51756 | | 2024-11-05 | The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code. cap-std's filesys… | |
CVE-2024-51745 | Critical | 10.0 | 2024-11-05 | Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such a… |
CVE-2024-51116 | High | 8.8 | 2024-11-05 | Tenda AC6 v2.0 V15.03.06.50 was discovered to contain a buffer overflow in the function 'formSetPPTPServer'. |
CVE-2024-10084 | Medium | 4.3 | 2024-11-05 | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and including, 4.5 via th… |
CVE-2024-7995 | High | 7.8 | 2024-11-05 | A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized… |
CVE-2024-51753 | | 2024-11-05 | The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions ref… | |
CVE-2024-51752 | Medium | 5.5 | 2024-11-05 | The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions… |
CVE-2024-51746 | | 2024-11-05 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online… | |
CVE-2024-51740 | Medium | 4.3 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low priv… |
CVE-2024-51735 | | 2024-11-05 | Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allo… | |
CVE-2024-51493 | Medium | 5.3 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows a… |
CVE-2024-51382 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can resul… |
CVE-2024-51381 | High | 8.4 | 2024-11-05 | Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin… |
CVE-2024-51380 | High | 8.4 | 2024-11-05 | Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaSc… |
CVE-2024-51379 | High | 8.4 | 2024-11-05 | Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where a… |
CVE-2024-51240 | High | 8.0 | 2024-11-05 | An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed b… |
CVE-2024-50335 | Medium | 4.9 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile pa… |
CVE-2024-50333 | Medium | 6.6 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the fil… |
CVE-2024-50332 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL… |
CVE-2024-49774 | High | 7.2 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods… |
CVE-2024-49773 | Medium | 5.3 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated… |
CVE-2024-49772 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation al… |
CVE-2024-49377 | Medium | 5.5 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities… |
CVE-2024-0134 | Medium | 4.1 | 2024-11-05 | NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of u… |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2024-50138 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a t… |
CVE-2024-50137 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will… |
CVE-2024-50136 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and… |
CVE-2024-50135 | Medium | 4.7 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modi… |
CVE-2024-50134 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace… |
CVE-2024-50133 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO ma… |
CVE-2024-50132 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a trace_probe we would se… |
CVE-2024-50131 | High | 7.3 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a… |
CVE-2024-50130 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in _… |
CVE-2024-50129 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds acc… |
CVE-2024-50128 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: fix global oob in wwan_rtnl_policy The variable wwan_rtnl_link_ops assign a *b… |
CVE-2024-50127 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin' pointer m… |
CVE-2024-50126 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: net: sched: use RCU read-side critical section in taprio_dump() Fix possible use-after-fr… |
CVE-2024-50125 | High | 8.0 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_sock_timeout conn->sk maybe have been unlinked/freed while… |
CVE-2024-50124 | High | 8.0 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on iso_sock_timeout conn->sk maybe have been unlinked/freed while… |
CVE-2024-50123 | High | 7.1 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: Add the missing BPF_LINK_TYPE invocation for sockmap There is an out-of-bounds read… |
CVE-2024-50122 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: PCI: Hold rescan lock while adding devices during host probe Since adding the PCI power c… |
CVE-2024-50121 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net In the normal… |
CVE-2024-50120 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicati… |
CVE-2024-50119 | High | 7.0 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: cifs: fix warning when destroy 'cifs_io_request_pool' There's a issue as follows: WARNING… |
CVE-2024-50118 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reject ro->rw reconfiguration if there are hard ro requirements [BUG] Syzbot repor… |
CVE-2024-50117 | High | 7.3 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in respo… |
CVE-2024-50116 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that… |
CVE-2024-50115 | High | 8.4 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading… |
CVE-2024-50114 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller… |
CVE-2024-50113 | High | 8.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix invalid port index for parent device In a commit 24b7f8e5cd65 ("firew… |
CVE-2024-50112 | High | 7.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESS_MASKING in most cases Linear Address Masking (LAM) has a weaknes… |
CVE-2024-50111 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context Unaligned access excep… |
CVE-2024-50110 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following iss… |
CVE-2024-50109 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null ptr dereference in raid10_size() In raid10_run() if raid10_set_queue_… |
CVE-2024-50108 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Stuart Hayhurst has found that b… |
CVE-2024-50107 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses Commit 5… |
CVE-2024-50106 | Critical | 9.8 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat han… |
CVE-2024-50105 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc Commit 15c7fab0e047 ("ASoC… |
CVE-2024-50104 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sdm845: add missing soundwire runtime stream alloc During the migration of So… |