2024 CVEs (page 137)
Page 137 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38002 | Critical | 9.0 | 2024-10-22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through upda… |
CVE-2024-26273 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26272 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26271 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q… |
CVE-2024-50312 | Medium | 5.3 | 2024-10-22 | A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comp… |
CVE-2024-50311 | Medium | 6.5 | 2024-10-22 | A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability ari… |
CVE-2024-10234 | Medium | 6.1 | 2024-10-22 | A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider t… |
CVE-2024-9050 | High | 7.8 | 2024-10-22 | A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from… |
CVE-2024-9231 | Medium | 6.1 | 2024-10-22 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap… |
CVE-2024-10189 | Medium | 6.4 | 2024-10-22 | The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode… |
CVE-2024-9987 | High | 8.8 | 2024-10-22 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora F… |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2024-9591 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and in… |
CVE-2024-9590 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_t… |
CVE-2024-9589 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_… |
CVE-2024-9588 | Medium | 5.4 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to… |
CVE-2024-9541 | Medium | 4.3 | 2024-10-22 | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render f… |
CVE-2024-9627 | High | 8.6 | 2024-10-22 | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_p… |
CVE-2024-8852 | Medium | 5.3 | 2024-10-22 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through… |
CVE-2024-10003 | Medium | 6.3 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2024-10002 | High | 8.8 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation… |
CVE-2024-9677 | Medium | 5.5 | 2024-10-22 | The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow… |
CVE-2024-8901 | High | 7.5 | 2024-10-22 | The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authenti… |
CVE-2024-10125 | High | 7.5 | 2024-10-22 | The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware… |
CVE-2024-47224 | Medium | 6.5 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-41714 | High | 8.8 | 2024-10-21 | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1… |
CVE-2024-41713 | Critical | 9.1 | 2024-10-21 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to c… |
CVE-2024-41712 | Medium | 6.6 | 2024-10-21 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack… |
CVE-2024-40091 | Medium | 5.3 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive… |
CVE-2024-40090 | Medium | 4.3 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers… |
CVE-2024-40089 | Critical | 9.1 | 2024-10-21 | A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell c… |
CVE-2024-40088 | Medium | 5.3 | 2024-10-21 | A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the exis… |
CVE-2024-40087 | Critical | 9.6 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauth… |
CVE-2024-40086 | Critical | 9.6 | 2024-10-21 | A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attac… |
CVE-2024-40085 | Critical | 9.6 | 2024-10-21 | A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to ex… |
CVE-2024-40084 | Critical | 9.6 | 2024-10-21 | A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exception… |
CVE-2024-40083 | Critical | 9.6 | 2024-10-21 | A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to e… |
CVE-2024-35315 | Medium | 5.6 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an a… |
CVE-2024-35314 | Critical | 9.8 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an u… |
CVE-2024-35287 | Medium | 6.7 | 2024-10-21 | A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with adminis… |
CVE-2024-35286 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insuf… |
CVE-2024-35285 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to i… |
CVE-2024-30160 | Medium | 4.8 | 2024-10-21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priv… |
CVE-2024-30159 | Medium | 4.8 | 2024-10-21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to c… |
CVE-2024-30158 | High | 7.2 | 2024-10-21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to c… |
CVE-2024-30157 | High | 7.2 | 2024-10-21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priv… |
CVE-2024-50065 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfs_d_hash d_hash is done while under "rcu-w… |
CVE-2024-50064 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: zram: free secondary algorithms names We need to kfree() secondary algorithms names when… |
CVE-2024-50063 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attache… |
CVE-2024-50062 | High | 7.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Avoid null pointer deref during path establishment For RTRS path establish… |
CVE-2024-50061 | High | 7.0 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race… |
CVE-2024-50060 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In terms of normal applica… |
CVE-2024-50059 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to rac… |
CVE-2024-50058 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: serial: protect uart_port_dtr_rts() in uart_shutdown() too Commit af224ca2df29 (serial: c… |
CVE-2024-50057 | Low | 3.3 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Free IRQ only if it was requested before In polling mode, if no IRQ was… |
CVE-2024-50056 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c Fix potential dereferencing of ER… |
CVE-2024-50055 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any er… |
CVE-2024-50049 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se [WHAT & HOW] se is null check… |
CVE-2024-50048 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: fbcon: Fix a NULL pointer dereference issue in fbcon_putcs syzbot has found a NULL pointe… |
CVE-2024-50047 | Critical | 9.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes w… |
CVE-2024-50046 | Critical | 9.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() On the node of an NFS… |
CVE-2024-50045 | High | 7.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in the br_net… |
CVE-2024-50044 | Low | 3.3 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_state_change… |
CVE-2024-50043 | Critical | 9.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the s… |
CVE-2024-50042 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix increasing MSI-X on VF Increasing MSI-X value on a VF leads to invalid memory op… |
CVE-2024-50041 | High | 8.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash This patch addresses a… |
CVE-2024-50040 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 ("igb: Fix igb_… |
CVE-2024-50039 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using q… |
CVE-2024-50038 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid NFPROTO_UNSPEC where needed syzbot managed to call xt_cluster m… |
CVE-2024-50037 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 ("drm/fbdev-dma… |
CVE-2024-50036 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data… |
CVE-2024-50035 | High | 7.1 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode()… |
CVE-2024-50034 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC Eric report a panic on IPPROTO_SMC, a… |
CVE-2024-50033 | Critical | 9.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_r… |
CVE-2024-50031 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop the active perfmon before being destroyed When running `kmscube` with one o… |
CVE-2024-50030 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in send_recv() Ensure we serialize with completion side to prevent… |
CVE-2024-50029 | High | 8.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection… |
CVE-2024-50028 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Reference count the zone in thermal_zone_get_by_id() There are places in t… |
CVE-2024-50027 | High | 7.8 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Free tzp copy along with the thermal zone The object pointed to by tz->tzp… |
CVE-2024-50026 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: scsi: wd33c93: Don't use stale scsi_pointer value A regression was introduced with commit… |
CVE-2024-50025 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Move flush_work initialization out of if block After commit 379a58caa199 ("sc… |
CVE-2024-50024 | High | 7.3 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetlink family… |
CVE-2024-50023 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net: phy: Remove LED entry from LEDs list on unregister Commit c938ab4da0eb ("net: phy: M… |
CVE-2024-50022 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_… |
CVE-2024-50021 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins() This patch addresses… |
CVE-2024-50020 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count() This patch addre… |
CVE-2024-50019 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: kthread: unpark only parked kthread Calling into kthread unparking unconditionally is mos… |
CVE-2024-48659 | Critical | 9.8 | 2024-10-21 | An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component. |
CVE-2024-48645 | High | 7.5 | 2024-10-21 | In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "function" files used by th… |
CVE-2024-48597 | High | 8.1 | 2024-10-21 | Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit. |
CVE-2024-48509 | Critical | 9.8 | 2024-10-21 | Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to… |
CVE-2024-47912 | High | 8.2 | 2024-10-21 | A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated atta… |
CVE-2024-47223 | Critical | 9.4 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-47189 | High | 7.7 | 2024-10-21 | The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated att… |
CVE-2024-46326 | Medium | 6.1 | 2024-10-21 | Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function. |
CVE-2024-31007 | Medium | 5.5 | 2024-10-21 | Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file. Affected component is IrfanVie… |
CVE-2024-50017 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/ident_map: Use gbpages only where full GB page should be mapped. When ident_pud_in… |
CVE-2024-50015 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ext4: dax: fix overflowing extents beyond inode size when partially writing The dax_iomap… |
CVE-2024-50014 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix access to uninitialised lock in fc replay path The following kernel trace can b… |
CVE-2024-50013 | Medium | 5.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix memory leak in exfat_load_bitmap() If the first directory entry in the root di… |