2024 CVEs (page 154)
Page 154 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47976 | Medium | 6.7 | 2024-10-07 | Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access. |
CVE-2024-47972 | Medium | 4.0 | 2024-10-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource. |
CVE-2024-47971 | Medium | 6.5 | 2024-10-07 | Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service. |
CVE-2024-47079 | Medium | 6.4 | 2024-10-07 | Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmwa… |
CVE-2024-45293 | High | 7.5 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader… |
CVE-2024-45292 | Medium | 5.4 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs fr… |
CVE-2024-31449 | High | 7.0 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overf… |
CVE-2024-31228 | Medium | 5.5 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string… |
CVE-2024-31227 | Medium | 4.4 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-47975 | High | 7.0 | 2024-10-07 | Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attack… |
CVE-2024-47559 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47558 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47557 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-47556 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-45894 | Medium | 4.9 | 2024-10-07 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. |
CVE-2024-44068 | High | 8.1 | 2024-10-07 | An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W920. A Use-After-Free… |
CVE-2024-47555 | High | 8.3 | 2024-10-07 | Missing Authentication - User & System Configuration |
CVE-2024-46076 | Critical | 9.8 | 2024-10-07 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code. |
CVE-2024-44674 | Medium | 5.7 | 2024-10-07 | D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. In the function sub_24E28, the HTTP_REFERER is obtained through an environment variable, and this… |
CVE-2024-42831 | Medium | 6.1 | 2024-10-07 | A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the… |
CVE-2024-46300 | Medium | 6.1 | 2024-10-07 | itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. |
CVE-2024-27458 | High | 8.8 | 2024-10-07 | A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing miti… |
CVE-2024-9570 | High | 8.8 | 2024-10-07 | A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform… |
CVE-2024-46446 | Critical | 9.8 | 2024-10-07 | Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passe… |
CVE-2024-46278 | High | 8.4 | 2024-10-07 | Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console. |
CVE-2024-46041 | High | 8.8 | 2024-10-07 | IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. |
CVE-2024-46040 | Medium | 6.5 | 2024-10-07 | IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT… |
CVE-2024-45932 | Medium | 4.8 | 2024-10-07 | Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. |
CVE-2024-28710 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and outp… |
CVE-2024-28709 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and… |
CVE-2024-9576 | High | 7.0 | 2024-10-07 | Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script. |
CVE-2024-9574 | Critical | 9.8 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a speciall… |
CVE-2024-9573 | Medium | 6.3 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specia… |
CVE-2024-9572 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in th… |
CVE-2024-9571 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affe… |
CVE-2024-9569 | High | 8.8 | 2024-10-07 | A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the… |
CVE-2024-9568 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNet… |
CVE-2024-45933 | Medium | 6.6 | 2024-10-07 | OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin… |
CVE-2024-9567 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /gofo… |
CVE-2024-9566 | High | 8.8 | 2024-10-07 | A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formD… |
CVE-2024-46325 | Medium | 5.5 | 2024-10-07 | TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url. |
CVE-2024-45153 | Medium | 5.4 | 2024-10-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-43047 | High | 7.8 | 2024-10-07 | Memory corruption while maintaining memory maps of HLOS memory. |
CVE-2024-42027 | Medium | 6.7 | 2024-10-07 | The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate t… |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-38399 | High | 8.4 | 2024-10-07 | Memory corruption while processing user packets to generate page faults. |
CVE-2024-38397 | High | 7.5 | 2024-10-07 | Transient DOS while parsing probe response and assoc response frame. |
CVE-2024-33073 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33071 | High | 7.5 | 2024-10-07 | Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0. |
CVE-2024-33070 | High | 7.5 | 2024-10-07 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33069 | High | 7.5 | 2024-10-07 | Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host. |
CVE-2024-33066 | Critical | 9.8 | 2024-10-07 | Memory corruption while redirecting log file to any file location with any file name. |
CVE-2024-33065 | High | 8.4 | 2024-10-07 | Memory corruption while taking snapshot when an offset variable is set by camera driver. |
CVE-2024-33064 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the multiple MBSSID IEs from the beacon. |
CVE-2024-33049 | High | 7.5 | 2024-10-07 | Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
CVE-2024-23379 | Medium | 6.7 | 2024-10-07 | Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario. |
CVE-2024-23378 | Medium | 6.7 | 2024-10-07 | Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record. |
CVE-2024-23376 | Medium | 6.7 | 2024-10-07 | Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call. |
CVE-2024-23375 | Medium | 6.7 | 2024-10-07 | Memory corruption during the network scan request. |
CVE-2024-23374 | Medium | 6.7 | 2024-10-07 | Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file. |
CVE-2024-23370 | Medium | 6.7 | 2024-10-07 | Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the sam… |
CVE-2024-23369 | High | 7.8 | 2024-10-07 | Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers. |
CVE-2024-21455 | High | 7.8 | 2024-10-07 | Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver. |
CVE-2024-47344 | Medium | 5.3 | 2024-10-07 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5. |
CVE-2024-47335 | High | 7.6 | 2024-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2024-20103 | Critical | 9.8 | 2024-10-07 | In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional executi… |
CVE-2024-20102 | Medium | 4.9 | 2024-10-07 | In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with System execution… |
CVE-2024-20101 | Critical | 9.8 | 2024-10-07 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution… |
CVE-2024-20100 | Critical | 9.8 | 2024-10-07 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution… |
CVE-2024-20099 | Medium | 6.7 | 2024-10-07 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20098 | Medium | 6.7 | 2024-10-07 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20097 | Medium | 4.4 | 2024-10-07 | In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20096 | Medium | 4.4 | 2024-10-07 | In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20095 | Medium | 4.4 | 2024-10-07 | In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20094 | High | 7.5 | 2024-10-07 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges n… |
CVE-2024-20093 | Medium | 4.4 | 2024-10-07 | In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20092 | High | 7.8 | 2024-10-07 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-20091 | Medium | 4.4 | 2024-10-07 | In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20090 | Medium | 6.7 | 2024-10-07 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-9565 | High | 8.8 | 2024-10-07 | A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. Affected by this vulnerability is the function formSetPassword of th… |
CVE-2024-9564 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. Affected is the function formWlanWizardSetup of the file /goform/… |
CVE-2024-9563 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the… |
CVE-2024-9562 | High | 8.8 | 2024-10-06 | A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The ma… |
CVE-2024-9561 | High | 8.8 | 2024-10-06 | A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The m… |
CVE-2024-9560 | Medium | 6.3 | 2024-10-06 | A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is the function delCatelogs of the file /CDGServer3/documen… |
CVE-2024-9559 | High | 8.8 | 2024-10-06 | A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formWlanSetup of the file /goform/formW… |
CVE-2024-9558 | High | 8.8 | 2024-10-06 | A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSe… |
CVE-2024-9557 | High | 8.8 | 2024-10-06 | A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file… |
CVE-2024-9556 | High | 8.8 | 2024-10-06 | A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetEnableWizard of the file /goform… |
CVE-2024-9555 | High | 8.8 | 2024-10-06 | A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of… |
CVE-2024-47650 | Medium | 6.5 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issu… |
CVE-2024-47350 | Critical | 9.3 | 2024-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-aj… |
CVE-2024-47338 | High | 8.5 | 2024-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-f… |
CVE-2024-45252 | Critical | 9.8 | 2024-10-06 | Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-45251 | Critical | 9.8 | 2024-10-06 | Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-45250 | Medium | 4.3 | 2024-10-06 | ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-45249 | Critical | 9.8 | 2024-10-06 | Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2024-45248 | High | 7.5 | 2024-10-06 | Multi-DNC – CWE-35: Path Traversal: '.../...//' |
CVE-2024-44040 | Medium | 5.9 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shift… |
CVE-2024-44039 | Medium | 5.9 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issu… |