2024 CVEs (page 169)
Page 169 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46730 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure array index tg_inst won't be -1 [WHY & HOW] tg_inst will be a neg… |
CVE-2024-46729 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix incorrect size calculation for loop [WHY] fe_clk_en has size of 5 bu… |
CVE-2024-46728 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index for aux_rd_interval before using aux_rd_interval has size of… |
CVE-2024-46727 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update [Why]… |
CVE-2024-46726 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow [WHY & HOW] Make sure vmid0p7… |
CVE-2024-46725 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-b… |
CVE-2024-46724 | High | 7.1 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Check the fb_channel_number… |
CVE-2024-46723 | High | 7.1 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode[] may out-… |
CVE-2024-46722 | High | 7.1 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mc_data out-of-bounds read warning Clear warning that read mc_data[i-1] m… |
CVE-2024-46721 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix possible NULL pointer dereference profile->parent->dents[AAFS_PROF_DIR] cou… |
CVE-2024-46720 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix dereference after null check check the pointer hive before use. |
CVE-2024-46719 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix null pointer dereference in trace ucsi_register_altmode checks IS_E… |
CVE-2024-46718 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't overmap identity VRAM mapping Overmapping the identity VRAM mapping is trig… |
CVE-2024-46717 | Critical | 9.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb c… |
CVE-2024-46716 | High | 7.8 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor Remove list_… |
CVE-2024-46715 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: driver: iio: add missing checks on iio_info's callback access Some callbacks from iio_inf… |
CVE-2024-46714 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Callers can pass null in… |
CVE-2024-43778 | High | 8.8 | 2024-09-18 | OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to exe… |
CVE-2024-41929 | High | 8.8 | 2024-09-18 | Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to… |
CVE-2024-6641 | Medium | 5.3 | 2024-09-18 | The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This… |
CVE-2024-45366 | Medium | 6.1 | 2024-09-18 | Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-42404 | High | 8.8 | 2024-09-18 | SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in… |
CVE-2024-45679 | High | 8.4 | 2024-09-18 | Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted f… |
CVE-2024-44005 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-b… |
CVE-2024-44003 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allow… |
CVE-2024-44002 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This… |
CVE-2024-44001 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.Th… |
CVE-2024-43999 | Medium | 5.9 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This… |
CVE-2024-43995 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issu… |
CVE-2024-43994 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Kahuna allows Stored XSS.This issu… |
CVE-2024-43993 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Liquido allows Stored XSS.This iss… |
CVE-2024-43992 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue a… |
CVE-2024-43991 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webdzier Hotel Galaxy allows Stored XSS.This issue… |
CVE-2024-43988 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digitalnature Mystique allows Stored XSS.This issu… |
CVE-2024-43987 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wayneconnor Sliding Door allows Stored XSS.This is… |
CVE-2024-43983 | Medium | 6.5 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XS… |
CVE-2024-43975 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp.This is… |
CVE-2024-43972 | Medium | 5.9 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This is… |
CVE-2024-43971 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart… |
CVE-2024-43970 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.This issue affects S… |
CVE-2024-45452 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Septera septera allows Stored XSS.This i… |
CVE-2024-45451 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Roseta roseta allows Stored XSS.This iss… |
CVE-2024-44064 | High | 7.1 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.This issue… |
CVE-2024-44051 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) cu… |
CVE-2024-44050 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This i… |
CVE-2024-44049 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue af… |
CVE-2024-44047 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum all… |
CVE-2024-44009 | High | 7.1 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace all… |
CVE-2024-44008 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This… |
CVE-2024-44007 | High | 7.1 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Templates – Elementor & Gutenberg templa… |
CVE-2024-44004 | Critical | 9.3 | 2024-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injec… |
CVE-2024-43985 | Medium | 5.9 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Bus Ticket Booking with Seat Reser… |
CVE-2024-43978 | Critical | 9.3 | 2024-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This is… |
CVE-2024-43977 | Medium | 5.9 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2024-43976 | Critical | 9.3 | 2024-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This is… |
CVE-2024-43969 | High | 7.6 | 2024-09-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This… |
CVE-2024-43938 | Medium | 6.5 | 2024-09-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue af… |
CVE-2024-37985 | Medium | 5.9 | 2024-09-17 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-46982 | High | 7.5 | 2024-09-17 | Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic s… |
CVE-2024-8957 | High | 7.2 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr config… |
CVE-2024-8909 | Medium | 4.3 | 2024-09-17 | Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2024-8908 | Medium | 4.3 | 2024-09-17 | Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2024-8907 | Medium | 6.1 | 2024-09-17 | Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2024-8906 | Medium | 4.3 | 2024-09-17 | Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2024-8905 | High | 8.8 | 2024-09-17 | Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML… |
CVE-2024-8904 | High | 8.8 | 2024-09-17 | Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-46976 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject execu… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-45815 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plu… |
CVE-2024-8956 | Critical | 9.1 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to… |
CVE-2024-8951 | Low | 3.5 | 2024-09-17 | A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-45812 | Medium | 6.4 | 2024-09-17 | Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scrip… |
CVE-2024-45811 | Medium | 4.8 | 2024-09-17 | Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies acces… |
CVE-2024-45606 | High | 7.1 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and pro… |
CVE-2024-45605 | Medium | 6.5 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary u… |
CVE-2024-45604 | Medium | 4.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Us… |
CVE-2024-45398 | High | 8.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. U… |
CVE-2024-8949 | Medium | 6.3 | 2024-09-17 | A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php o… |
CVE-2024-8948 | High | 7.3 | 2024-09-17 | A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. Th… |
CVE-2024-8947 | Medium | 5.6 | 2024-09-17 | A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/ob… |
CVE-2024-8946 | High | 7.3 | 2024-09-17 | A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the com… |
CVE-2024-8900 | High | 7.5 | 2024-09-17 | An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects F… |
CVE-2024-8660 | Medium | 4.8 | 2024-09-17 | Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was… |
CVE-2024-45803 | Medium | 6.1 | 2024-09-17 | Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (XSS) vulnerability… |
CVE-2024-45798 | Critical | 9.9 | 2024-09-17 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to m… |
CVE-2024-45612 | Medium | 5.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (fr… |
CVE-2024-45537 | Medium | 6.5 | 2024-09-17 | Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid… |
CVE-2024-45384 | Medium | 5.3 | 2024-09-17 | Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apa… |
CVE-2024-43460 | High | 8.1 | 2024-09-17 | Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network. |
CVE-2024-38183 | Critical | 9.8 | 2024-09-17 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-8945 | Medium | 5.5 | 2024-09-17 | A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-8944 | High | 7.3 | 2024-09-17 | A vulnerability, which was classified as critical, was found in code-projects Hospital Management System 1.0. This affects an unknown part of the file check_av… |
CVE-2024-8796 | Medium | 5.3 | 2024-09-17 | Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum de… |
CVE-2024-45682 | High | 8.8 | 2024-09-17 | There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. |
CVE-2024-42503 | High | 7.2 | 2024-09-17 | Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the… |
CVE-2024-42502 | High | 7.2 | 2024-09-17 | Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability… |
CVE-2024-42501 | High | 7.2 | 2024-09-17 | An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned pac… |
CVE-2024-38813 | High | 7.5 | 2024-09-17 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to esc… |
CVE-2024-38812 | Critical | 9.8 | 2024-09-17 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server… |
CVE-2024-38380 | Medium | 5.5 | 2024-09-17 | This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbit… |