2024 CVEs (page 162)
Page 162 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46846 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: spi: rockchip: Resolve unbalanced runtime PM / system PM handling Commit e882575efc77 ("s… |
CVE-2024-46845 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user s… |
CVE-2024-46844 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: um: line: always fill *error_out in setup_one_line() The pointer isn't initialized by cal… |
CVE-2024-46843 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver fro… |
CVE-2024-46842 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info The MBX_TIMEOUT return code is n… |
CVE-2024-46841 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() We hand… |
CVE-2024-46840 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0… |
CVE-2024-46838 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: userfaultfd: don't BUG_ON() if khugepaged yanks our page table Since khugepaged was chang… |
CVE-2024-46837 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on group_create We were allowing any users to creat… |
CVE-2024-46836 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound o… |
CVE-2024-46835 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix smatch static checker warning adev->gfx.imu.funcs could be NULL |
CVE-2024-46834 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d… |
CVE-2024-46833 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops… |
CVE-2024-46832 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warni… |
CVE-2024-46831 | High | 8.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-fr… |
CVE-2024-46830 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when process… |
CVE-2024-46829 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called… |
CVE-2024-46828 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep tr… |
CVE-2024-46827 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix firmware crash due to invalid peer nss Currently, if the access point r… |
CVE-2024-46826 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice… |
CVE-2024-46825 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check The lookup function iwl_mvm_rcu_fw… |
CVE-2024-46824 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this… |
CVE-2024-46823 | High | 8.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist… |
CVE-2024-46822 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussio… |
CVE-2024-46821 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix negative array index read Avoid using the negative values for clk_idex as… |
CVE-2024-46820 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend We do not directly enable/disable V… |
CVE-2024-46819 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 if ras_manager obj null, don't pr… |
CVE-2024-46818 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpio_id before used as array index [WHY & HOW] GPIO_ID_UNKNOWN (-1… |
CVE-2024-46817 | High | 7.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity… |
CVE-2024-46816 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links [Why] Co… |
CVE-2024-46815 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] [WHY & HOW] num_v… |
CVE-2024-46814 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msg_id before processing transcation [WHY & HOW] HDCP_MESSAGE_ID_I… |
CVE-2024-46813 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_index before accessing dc->links[] [WHY & HOW] dc->links[] ha… |
CVE-2024-46812 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration [Why] Cove… |
CVE-2024-46811 | High | 7.3 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box [Why]… |
CVE-2024-46810 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Make… |
CVE-2024-46809 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check BIOS images before it is used BIOS images may fail to load and nul… |
CVE-2024-46808 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range [Why & H… |
CVE-2024-46807 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: Check tbo resource pointer Validate tbo resource pointer, skip if NULL |
CVE-2024-46806 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the warning division or modulo by zero Checks the partition mode and retu… |
CVE-2024-46805 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix the waring dereferencing hive Check the amdgpu_hive_info *hive that maybe… |
CVE-2024-46804 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add array index check for hdcp ddc access [Why] Coverity reports OVERRUN… |
CVE-2024-46803 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check debug trap enable before write dbg_ev_file In interrupt context, write… |
CVE-2024-46802 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: added NULL check at start of dc_validate_stream [Why] prevent invalid me… |
CVE-2024-46441 | High | 8.8 | 2024-09-27 | An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php… |
CVE-2024-9280 | Medium | 4.7 | 2024-09-27 | A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the… |
CVE-2024-9279 | Low | 2.4 | 2024-09-27 | A vulnerability, which was classified as problematic, was found in funnyzpc Mee-Admin up to 1.6. This affects an unknown part of the file /mee/index of the com… |
CVE-2024-8644 | High | 7.5 | 2024-09-27 | Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript… |
CVE-2024-8643 | Critical | 9.8 | 2024-09-27 | Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. |
CVE-2024-8609 | High | 7.5 | 2024-09-27 | Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: be… |
CVE-2024-8608 | Medium | 5.4 | 2024-09-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Oceanic Software ValeApp allows Stored XSS. This… |
CVE-2024-8607 | Critical | 9.8 | 2024-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection. This issu… |
CVE-2024-9278 | Medium | 4.7 | 2024-09-27 | A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verificat… |
CVE-2024-9277 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backe… |
CVE-2024-9276 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic has been found in TMsoft MyAuth Gateway 3. Affected is an unknown function of the file /index.php. The manipulation o… |
CVE-2024-9275 | Medium | 6.3 | 2024-09-27 | A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/ad… |
CVE-2024-9136 | Medium | 6.7 | 2024-09-27 | Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-47294 | Medium | 4.4 | 2024-09-27 | Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47293 | Medium | 4.7 | 2024-09-27 | Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47292 | Medium | 6.2 | 2024-09-27 | Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47291 | Medium | 5.6 | 2024-09-27 | Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47290 | Medium | 5.5 | 2024-09-27 | Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-6931 | High | 7.2 | 2024-09-27 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due t… |
CVE-2024-6654 | | 2024-09-27 | Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET s… | |
CVE-2024-41930 | Medium | 6.1 | 2024-09-27 | Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbitrary script may be… |
CVE-2024-38861 | High | 7.4 | 2024-09-27 | Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2… |
CVE-2024-39435 | Medium | 6.5 | 2024-09-27 | In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution… |
CVE-2024-39434 | Medium | 6.2 | 2024-09-27 | In drm service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2024-39433 | Medium | 6.2 | 2024-09-27 | In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2024-39432 | High | 8.3 | 2024-09-27 | In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution pri… |
CVE-2024-39431 | High | 8.3 | 2024-09-27 | In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution pr… |
CVE-2024-9049 | Medium | 6.4 | 2024-09-27 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versi… |
CVE-2024-9029 | High | 7.5 | 2024-09-27 | A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Me… |
CVE-2024-8991 | Medium | 6.4 | 2024-09-27 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and osm_map_v3 shortcodes in all versions up… |
CVE-2024-8681 | Medium | 6.4 | 2024-09-27 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all versions up to, an… |
CVE-2024-7400 | | 2024-09-27 | The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to del… | |
CVE-2024-9130 | High | 7.2 | 2024-09-27 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions… |
CVE-2024-8965 | Medium | 6.4 | 2024-09-27 | The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, an… |
CVE-2024-8922 | High | 8.8 | 2024-09-27 | The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includin… |
CVE-2024-7714 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to dis… |
CVE-2024-7713 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain… |
CVE-2024-7011 | Medium | 6.5 | 2024-09-27 | Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525WLG, NP-P525WLJL, NP… |
CVE-2024-8974 | Low | 2.6 | 2024-09-26 | Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions… |
CVE-2024-4099 | Low | 3.1 | 2024-09-26 | An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1… |
CVE-2024-47176 | Medium | 5.3 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discover… |
CVE-2024-47175 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does… |
CVE-2024-47076 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2024-40508 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConference.asmx function. |
CVE-2024-40507 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel.asmx function. |
CVE-2024-40506 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitality.asmx function. |
CVE-2024-6769 | Medium | 6.7 | 2024-09-26 | A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows S… |
CVE-2024-45986 | Medium | 5.4 | 2024-09-26 | A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a mali… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |
CVE-2024-47180 | High | 8.8 | 2024-09-26 | Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields u… |
CVE-2024-47179 | High | 8.8 | 2024-09-26 | RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could have lead to a ful… |
CVE-2024-46628 | Critical | 9.8 | 2024-09-26 | Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUS… |
CVE-2024-8118 | | 2024-09-26 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also writ… | |
CVE-2024-47174 | Medium | 5.9 | 2024-09-26 | Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verif… |
CVE-2024-47171 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |