2024 CVEs (page 162)
Page 162 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46818 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpio_id before used as array index [WHY & HOW] GPIO_ID_UNKNOWN (-1… |
CVE-2024-46817 | High | 7.4 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity… |
CVE-2024-46816 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links [Why] Co… |
CVE-2024-46815 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] [WHY & HOW] num_v… |
CVE-2024-46814 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msg_id before processing transcation [WHY & HOW] HDCP_MESSAGE_ID_I… |
CVE-2024-46813 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_index before accessing dc->links[] [WHY & HOW] dc->links[] ha… |
CVE-2024-46812 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration [Why] Cove… |
CVE-2024-46811 | High | 7.3 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box [Why]… |
CVE-2024-46810 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Make… |
CVE-2024-46809 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check BIOS images before it is used BIOS images may fail to load and nul… |
CVE-2024-46808 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range [Why & H… |
CVE-2024-46807 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: Check tbo resource pointer Validate tbo resource pointer, skip if NULL |
CVE-2024-46806 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the warning division or modulo by zero Checks the partition mode and retu… |
CVE-2024-46805 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix the waring dereferencing hive Check the amdgpu_hive_info *hive that maybe… |
CVE-2024-46804 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add array index check for hdcp ddc access [Why] Coverity reports OVERRUN… |
CVE-2024-46803 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check debug trap enable before write dbg_ev_file In interrupt context, write… |
CVE-2024-46802 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: added NULL check at start of dc_validate_stream [Why] prevent invalid me… |
CVE-2024-46441 | High | 8.8 | 2024-09-27 | An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php… |
CVE-2024-9280 | Medium | 4.7 | 2024-09-27 | A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the… |
CVE-2024-9279 | Low | 2.4 | 2024-09-27 | A vulnerability, which was classified as problematic, was found in funnyzpc Mee-Admin up to 1.6. This affects an unknown part of the file /mee/index of the com… |
CVE-2024-8644 | High | 7.5 | 2024-09-27 | Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript… |
CVE-2024-8643 | Critical | 9.8 | 2024-09-27 | Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. |
CVE-2024-8609 | High | 7.5 | 2024-09-27 | Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: be… |
CVE-2024-8608 | Medium | 5.4 | 2024-09-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Oceanic Software ValeApp allows Stored XSS. This… |
CVE-2024-8607 | Critical | 9.8 | 2024-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection. This issu… |
CVE-2024-9278 | Medium | 4.7 | 2024-09-27 | A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verificat… |
CVE-2024-9277 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backe… |
CVE-2024-9276 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic has been found in TMsoft MyAuth Gateway 3. Affected is an unknown function of the file /index.php. The manipulation o… |
CVE-2024-9275 | Medium | 6.3 | 2024-09-27 | A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/ad… |
CVE-2024-9136 | Medium | 6.7 | 2024-09-27 | Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2024-47294 | Medium | 4.4 | 2024-09-27 | Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47293 | Medium | 4.7 | 2024-09-27 | Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47292 | Medium | 6.2 | 2024-09-27 | Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47291 | Medium | 5.6 | 2024-09-27 | Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-47290 | Medium | 5.5 | 2024-09-27 | Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-9202 | Medium | 5.3 | 2024-09-27 | In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested ca… |
CVE-2024-6931 | High | 7.2 | 2024-09-27 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due t… |
CVE-2024-6654 | | 2024-09-27 | Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET s… | |
CVE-2024-41930 | Medium | 6.1 | 2024-09-27 | Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbitrary script may be… |
CVE-2024-38861 | High | 7.4 | 2024-09-27 | Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2… |
CVE-2024-39435 | Medium | 6.5 | 2024-09-27 | In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution… |
CVE-2024-39434 | Medium | 6.2 | 2024-09-27 | In drm service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileg… |
CVE-2024-39433 | Medium | 6.2 | 2024-09-27 | In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privile… |
CVE-2024-39432 | High | 8.3 | 2024-09-27 | In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution pri… |
CVE-2024-39431 | High | 8.3 | 2024-09-27 | In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution pr… |
CVE-2024-9049 | Medium | 6.4 | 2024-09-27 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versi… |
CVE-2024-9029 | High | 7.5 | 2024-09-27 | A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Me… |
CVE-2024-8991 | Medium | 6.4 | 2024-09-27 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and osm_map_v3 shortcodes in all versions up… |
CVE-2024-8681 | Medium | 6.4 | 2024-09-27 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Grid widget in all versions up to, an… |
CVE-2024-7400 | | 2024-09-27 | The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to del… | |
CVE-2024-9130 | High | 7.2 | 2024-09-27 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions… |
CVE-2024-8965 | Medium | 6.4 | 2024-09-27 | The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, an… |
CVE-2024-8922 | High | 8.8 | 2024-09-27 | The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includin… |
CVE-2024-7714 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to dis… |
CVE-2024-7713 | High | 7.5 | 2024-09-27 | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain… |
CVE-2024-7011 | Medium | 6.5 | 2024-09-27 | Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525WLG, NP-P525WLJL, NP… |
CVE-2024-8974 | Low | 2.6 | 2024-09-26 | Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions… |
CVE-2024-4099 | Low | 3.1 | 2024-09-26 | An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1… |
CVE-2024-47176 | Medium | 5.3 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discover… |
CVE-2024-47175 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does… |
CVE-2024-47076 | High | 8.6 | 2024-09-26 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2024-40508 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConference.asmx function. |
CVE-2024-40507 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel.asmx function. |
CVE-2024-40506 | High | 7.3 | 2024-09-26 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitality.asmx function. |
CVE-2024-6769 | Medium | 6.7 | 2024-09-26 | A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows S… |
CVE-2024-45986 | Medium | 5.4 | 2024-09-26 | A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a mali… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |
CVE-2024-47180 | High | 8.8 | 2024-09-26 | Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields u… |
CVE-2024-47179 | High | 8.8 | 2024-09-26 | RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could have lead to a ful… |
CVE-2024-46628 | Critical | 9.8 | 2024-09-26 | Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUS… |
CVE-2024-8118 | | 2024-09-26 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also writ… | |
CVE-2024-47174 | Medium | 5.9 | 2024-09-26 | Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verif… |
CVE-2024-47171 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-47170 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to re… |
CVE-2024-47169 | High | 8.8 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-47130 | High | 8.8 | 2024-09-26 | The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your a… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length o… |
CVE-2024-47128 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the enc… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio… |
CVE-2024-47126 | Medium | 6.5 | 2024-09-26 | The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attack… |
CVE-2024-47125 | High | 8.1 | 2024-09-26 | The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to th… |
CVE-2024-47124 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous vers… |
CVE-2024-47123 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages mal… |
CVE-2024-47122 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys store… |
CVE-2024-47121 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and… |
CVE-2024-47075 | Medium | 6.4 | 2024-09-26 | LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripti… |
CVE-2024-45989 | Medium | 4.0 | 2024-09-26 | Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attack… |
CVE-2024-45987 | Medium | 6.5 | 2024-09-26 | Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft… |
CVE-2024-45985 | Medium | 4.7 | 2024-09-26 | A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inject malicious scrip… |
CVE-2024-45984 | Medium | 4.7 | 2024-09-26 | A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts tha… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous… |
CVE-2024-45723 | Medium | 6.5 | 2024-09-26 | The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier fo… |
CVE-2024-45374 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over… |
CVE-2024-45042 | Medium | 4.4 | 2024-09-26 | Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_… |
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is a… |
CVE-2024-43694 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys… |
CVE-2024-43108 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves mess… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share t… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software define… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |