2024 CVEs (page 161)
Page 161 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46453 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-6436 | Medium | 6.5 | 2024-09-27 | An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the serve… |
CVE-2024-9160 | | 2024-09-27 | In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. | |
CVE-2024-33369 | High | 8.8 | 2024-09-27 | Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection… |
CVE-2024-33368 | High | 8.8 | 2024-09-27 | An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen |
CVE-2024-9301 | High | 7.5 | 2024-09-27 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a |
CVE-2024-46257 | Medium | 6.3 | 2024-09-27 | A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via… |
CVE-2024-46256 | Critical | 9.8 | 2024-09-27 | A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate. |
CVE-2024-46097 | High | 8.1 | 2024-09-27 | TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is a… |
CVE-2024-39364 | Medium | 6.3 | 2024-09-27 | Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, re… |
CVE-2024-39275 | High | 8.0 | 2024-09-27 | Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if… |
CVE-2024-38308 | High | 8.8 | 2024-09-27 | Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neu… |
CVE-2024-37187 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. |
CVE-2024-34542 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process. |
CVE-2024-28948 | High | 8.0 | 2024-09-27 | Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin policy, which is de… |
CVE-2024-25412 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-25411 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-9284 | Medium | 6.5 | 2024-09-27 | A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-8630 | Critical | 9.4 | 2024-09-27 | Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database. |
CVE-2024-8310 | Critical | 9.8 | 2024-09-27 | OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges. |
CVE-2024-6981 | Critical | 9.8 | 2024-09-27 | OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication. |
CVE-2024-46367 | Critical | 9.6 | 2024-09-27 | A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malici… |
CVE-2024-46366 | High | 8.8 | 2024-09-27 | A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by inje… |
CVE-2024-38809 | Medium | 5.3 | 2024-09-27 | Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to th… |
CVE-2024-22170 | | 2024-09-27 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.T… | |
CVE-2024-6983 | High | 8.8 | 2024-09-27 | mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the co… |
CVE-2024-47077 | Medium | 6.5 | 2024-09-27 | authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that applicati… |
CVE-2024-47070 | Critical | 9.0 | 2024-09-27 | authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding… |
CVE-2024-45745 | Medium | 5.0 | 2024-09-27 | TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access U… |
CVE-2024-45744 | Low | 3.0 | 2024-09-27 | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the… |
CVE-2024-46472 | High | 8.6 | 2024-09-27 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. |
CVE-2024-46471 | High | 7.5 | 2024-09-27 | The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealin… |
CVE-2024-46470 | Medium | 6.1 | 2024-09-27 | Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in… |
CVE-2024-46333 | Medium | 4.8 | 2024-09-27 | An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-46331 | High | 7.2 | 2024-09-27 | ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to r… |
CVE-2024-44912 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c). |
CVE-2024-44911 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c). |
CVE-2024-44910 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c). |
CVE-2024-40510 | High | 8.2 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asmx function. |
CVE-2024-40509 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asmx function. |
CVE-2024-3373 | | 2024-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This i… | |
CVE-2024-9283 | Low | 3.3 | 2024-09-27 | A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converte… |
CVE-2024-7149 | High | 8.8 | 2024-09-27 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2024-47184 | Medium | 6.1 | 2024-09-27 | Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross… |
CVE-2024-47182 | Medium | 4.8 | 2024-09-27 | Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to… |
CVE-2024-45863 | Medium | 5.3 | 2024-09-27 | A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other unde… |
CVE-2024-45773 | High | 7.5 | 2024-09-27 | A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirab… |
CVE-2024-40512 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.asmx function. |
CVE-2024-40511 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmin.asmx function. |
CVE-2024-9282 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipul… |
CVE-2024-9281 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The… |
CVE-2024-46868 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire() If the __qcuefi pointer is n… |
CVE-2024-46867 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in show_meminfo() There is a real deadlock as well as sleepin… |
CVE-2024-46866 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in show_meminfo() bo_meminfo() wants to inspect bo… |
CVE-2024-46865 | Critical | 9.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition… |
CVE-2024-46864 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: fix kexec crash due to VP assist page corruption commit 9636be85cc5b ("x86/hy… |
CVE-2024-46863 | High | 7.3 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There is no links_num in st… |
CVE-2024-46862 | High | 8.0 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There is no links_num in st… |
CVE-2024-46861 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple… |
CVE-2024-46860 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change When disabling wif… |
CVE-2024-46859 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic lapto… |
CVE-2024-46858 | High | 8.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_… |
CVE-2024-46857 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the b… |
CVE-2024-46856 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices The probe() function i… |
CVE-2024-46855 | High | 7.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. |
CVE-2024-46854 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: dpaa: Pad packets to ETH_ZLEN When sending packets under 60 bytes, up to three bytes… |
CVE-2024-46853 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the… |
CVE-2024-46852 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in… |
CVE-2024-46851 | Medium | 4.7 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct() dc_state_dest… |
CVE-2024-46850 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct() dc_state_dest… |
CVE-2024-46849 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is reallocated in 'me… |
CVE-2024-46848 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrent… |
CVE-2024-46847 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: ensure vmap_block is initialised before adding to queue Commit 8c61291fd850… |
CVE-2024-46846 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: spi: rockchip: Resolve unbalanced runtime PM / system PM handling Commit e882575efc77 ("s… |
CVE-2024-46845 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user s… |
CVE-2024-46844 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: um: line: always fill *error_out in setup_one_line() The pointer isn't initialized by cal… |
CVE-2024-46843 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver fro… |
CVE-2024-46842 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info The MBX_TIMEOUT return code is n… |
CVE-2024-46841 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() We hand… |
CVE-2024-46840 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0… |
CVE-2024-46838 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: userfaultfd: don't BUG_ON() if khugepaged yanks our page table Since khugepaged was chang… |
CVE-2024-46837 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on group_create We were allowing any users to creat… |
CVE-2024-46836 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound o… |
CVE-2024-46835 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix smatch static checker warning adev->gfx.imu.funcs could be NULL |
CVE-2024-46834 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d… |
CVE-2024-46833 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops… |
CVE-2024-46832 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warni… |
CVE-2024-46831 | High | 8.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-fr… |
CVE-2024-46830 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when process… |
CVE-2024-46829 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called… |
CVE-2024-46828 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep tr… |
CVE-2024-46827 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix firmware crash due to invalid peer nss Currently, if the access point r… |
CVE-2024-46826 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice… |
CVE-2024-46825 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check The lookup function iwl_mvm_rcu_fw… |
CVE-2024-46824 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this… |
CVE-2024-46823 | High | 8.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist… |
CVE-2024-46822 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussio… |
CVE-2024-46821 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix negative array index read Avoid using the negative values for clk_idex as… |
CVE-2024-46820 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend We do not directly enable/disable V… |
CVE-2024-46819 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 if ras_manager obj null, don't pr… |