2024 CVEs (page 154)
Page 154 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39806 | Medium | 5.5 | 2024-10-08 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-37179 | High | 7.7 | 2024-10-08 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to… |
CVE-2024-47969 | Medium | 6.2 | 2024-10-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47968 | Medium | 4.4 | 2024-10-07 | Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47818 | Medium | 6.5 | 2024-10-07 | Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by ca… |
CVE-2024-47817 | Medium | 6.1 | 2024-10-07 | Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes… |
CVE-2024-47814 | Low | 3.9 | 2024-10-07 | Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto c… |
CVE-2024-47782 | High | 7.6 | 2024-10-07 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on t… |
CVE-2024-47781 | Medium | 6.1 | 2024-10-07 | CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user… |
CVE-2024-45874 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the s… |
CVE-2024-45873 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in th… |
CVE-2024-47974 | Medium | 4.4 | 2024-10-07 | Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47973 | Medium | 5.1 | 2024-10-07 | In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker. |
CVE-2024-47967 | Medium | 4.4 | 2024-10-07 | Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47772 | Medium | 6.5 | 2024-10-07 | Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted… |
CVE-2024-47610 | High | 7.3 | 2024-10-07 | InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown… |
CVE-2024-45919 | Medium | 6.5 | 2024-10-07 | A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Ty… |
CVE-2024-45297 | Medium | 5.3 | 2024-10-07 | Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has b… |
CVE-2024-45291 | Medium | 6.3 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from… |
CVE-2024-45290 | High | 7.7 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from… |
CVE-2024-45060 | High | 7.1 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scri… |
CVE-2024-45051 | High | 8.2 | 2024-10-07 | Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions… |
CVE-2024-43789 | High | 7.5 | 2024-10-07 | Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can… |
CVE-2024-43365 | Medium | 5.7 | 2024-10-07 | Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in li… |
CVE-2024-43364 | Medium | 5.7 | 2024-10-07 | Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . M… |
CVE-2024-43363 | High | 7.2 | 2024-10-07 | Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat… |
CVE-2024-43362 | High | 7.3 | 2024-10-07 | Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php`… |
CVE-2024-47976 | Medium | 6.7 | 2024-10-07 | Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access. |
CVE-2024-47972 | Medium | 4.0 | 2024-10-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource. |
CVE-2024-47971 | Medium | 6.5 | 2024-10-07 | Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service. |
CVE-2024-47079 | Medium | 6.4 | 2024-10-07 | Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmwa… |
CVE-2024-45293 | High | 7.5 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader… |
CVE-2024-45292 | Medium | 5.4 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs fr… |
CVE-2024-31449 | High | 7.0 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overf… |
CVE-2024-31228 | Medium | 5.5 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string… |
CVE-2024-31227 | Medium | 4.4 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-47975 | High | 7.0 | 2024-10-07 | Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attack… |
CVE-2024-47559 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47558 | High | 7.6 | 2024-10-07 | Authenticated RCE via Path Traversal |
CVE-2024-47557 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-47556 | High | 8.3 | 2024-10-07 | Pre-Auth RCE via Path Traversal |
CVE-2024-45894 | Medium | 4.9 | 2024-10-07 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. |
CVE-2024-44068 | High | 8.1 | 2024-10-07 | An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W920. A Use-After-Free… |
CVE-2024-47555 | High | 8.3 | 2024-10-07 | Missing Authentication - User & System Configuration |
CVE-2024-46076 | Critical | 9.8 | 2024-10-07 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code. |
CVE-2024-44674 | Medium | 5.7 | 2024-10-07 | D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. In the function sub_24E28, the HTTP_REFERER is obtained through an environment variable, and this… |
CVE-2024-42831 | Medium | 6.1 | 2024-10-07 | A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the… |
CVE-2024-46300 | Medium | 6.1 | 2024-10-07 | itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. |
CVE-2024-27458 | High | 8.8 | 2024-10-07 | A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing miti… |
CVE-2024-9570 | High | 8.8 | 2024-10-07 | A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform… |
CVE-2024-46446 | Critical | 9.8 | 2024-10-07 | Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passe… |
CVE-2024-46278 | High | 8.4 | 2024-10-07 | Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console. |
CVE-2024-46041 | High | 8.8 | 2024-10-07 | IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. |
CVE-2024-46040 | Medium | 6.5 | 2024-10-07 | IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT… |
CVE-2024-45932 | Medium | 4.8 | 2024-10-07 | Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. |
CVE-2024-28710 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and outp… |
CVE-2024-28709 | Medium | 6.1 | 2024-10-07 | Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and… |
CVE-2024-9576 | High | 7.0 | 2024-10-07 | Vulnerability in Distro Linux Workbooth v2.5 that allows to escalate privileges to the root user by manipulating the network configuration script. |
CVE-2024-9574 | Critical | 9.8 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a speciall… |
CVE-2024-9573 | Medium | 6.3 | 2024-10-07 | SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specia… |
CVE-2024-9572 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/groupe_save.php, in th… |
CVE-2024-9571 | Medium | 6.3 | 2024-10-07 | Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input via /soplanning/www/process/xajax_server.php, affe… |
CVE-2024-9569 | High | 8.8 | 2024-10-07 | A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the… |
CVE-2024-9568 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNet… |
CVE-2024-45933 | Medium | 6.6 | 2024-10-07 | OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin… |
CVE-2024-9567 | High | 8.8 | 2024-10-07 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /gofo… |
CVE-2024-9566 | High | 8.8 | 2024-10-07 | A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formD… |
CVE-2024-46325 | Medium | 5.5 | 2024-10-07 | TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url. |
CVE-2024-45153 | Medium | 5.4 | 2024-10-07 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-43047 | High | 7.8 | 2024-10-07 | Memory corruption while maintaining memory maps of HLOS memory. |
CVE-2024-42027 | Medium | 6.7 | 2024-10-07 | The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate t… |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-38399 | High | 8.4 | 2024-10-07 | Memory corruption while processing user packets to generate page faults. |
CVE-2024-38397 | High | 7.5 | 2024-10-07 | Transient DOS while parsing probe response and assoc response frame. |
CVE-2024-33073 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33071 | High | 7.5 | 2024-10-07 | Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0. |
CVE-2024-33070 | High | 7.5 | 2024-10-07 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33069 | High | 7.5 | 2024-10-07 | Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host. |
CVE-2024-33066 | Critical | 9.8 | 2024-10-07 | Memory corruption while redirecting log file to any file location with any file name. |
CVE-2024-33065 | High | 8.4 | 2024-10-07 | Memory corruption while taking snapshot when an offset variable is set by camera driver. |
CVE-2024-33064 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the multiple MBSSID IEs from the beacon. |
CVE-2024-33049 | High | 7.5 | 2024-10-07 | Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
CVE-2024-23379 | Medium | 6.7 | 2024-10-07 | Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario. |
CVE-2024-23378 | Medium | 6.7 | 2024-10-07 | Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record. |
CVE-2024-23376 | Medium | 6.7 | 2024-10-07 | Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call. |
CVE-2024-23375 | Medium | 6.7 | 2024-10-07 | Memory corruption during the network scan request. |
CVE-2024-23374 | Medium | 6.7 | 2024-10-07 | Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file. |
CVE-2024-23370 | Medium | 6.7 | 2024-10-07 | Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the sam… |
CVE-2024-23369 | High | 7.8 | 2024-10-07 | Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers. |
CVE-2024-21455 | High | 7.8 | 2024-10-07 | Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver. |
CVE-2024-47344 | Medium | 5.3 | 2024-10-07 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5. |
CVE-2024-47335 | High | 7.6 | 2024-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2024-20103 | Critical | 9.8 | 2024-10-07 | In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional executi… |
CVE-2024-20102 | Medium | 4.9 | 2024-10-07 | In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with System execution… |
CVE-2024-20101 | Critical | 9.8 | 2024-10-07 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution… |
CVE-2024-20100 | Critical | 9.8 | 2024-10-07 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution… |
CVE-2024-20099 | Medium | 6.7 | 2024-10-07 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20098 | Medium | 6.7 | 2024-10-07 | In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20097 | Medium | 4.4 | 2024-10-07 | In vdec, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2024-20096 | Medium | 4.4 | 2024-10-07 | In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |