2024 CVEs (page 170)
Page 170 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45606 | High | 7.1 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and pro… |
CVE-2024-45605 | Medium | 6.5 | 2024-09-17 | Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary u… |
CVE-2024-45604 | Medium | 4.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Us… |
CVE-2024-45398 | High | 8.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. U… |
CVE-2024-8949 | Medium | 6.3 | 2024-09-17 | A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php o… |
CVE-2024-8948 | High | 7.3 | 2024-09-17 | A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. Th… |
CVE-2024-8947 | Medium | 5.6 | 2024-09-17 | A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/ob… |
CVE-2024-8946 | High | 7.3 | 2024-09-17 | A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the com… |
CVE-2024-8900 | High | 7.5 | 2024-09-17 | An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects F… |
CVE-2024-8660 | Medium | 4.8 | 2024-09-17 | Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was… |
CVE-2024-45803 | Medium | 6.1 | 2024-09-17 | Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (XSS) vulnerability… |
CVE-2024-45798 | Critical | 9.9 | 2024-09-17 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to m… |
CVE-2024-45612 | Medium | 5.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (fr… |
CVE-2024-45537 | Medium | 6.5 | 2024-09-17 | Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid… |
CVE-2024-45384 | Medium | 5.3 | 2024-09-17 | Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apa… |
CVE-2024-43460 | High | 8.1 | 2024-09-17 | Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network. |
CVE-2024-38183 | Critical | 9.8 | 2024-09-17 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-8945 | Medium | 5.5 | 2024-09-17 | A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-8944 | High | 7.3 | 2024-09-17 | A vulnerability, which was classified as critical, was found in code-projects Hospital Management System 1.0. This affects an unknown part of the file check_av… |
CVE-2024-8796 | Medium | 5.3 | 2024-09-17 | Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum de… |
CVE-2024-45682 | High | 8.8 | 2024-09-17 | There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. |
CVE-2024-42503 | High | 7.2 | 2024-09-17 | Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the… |
CVE-2024-42502 | High | 7.2 | 2024-09-17 | Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability… |
CVE-2024-42501 | High | 7.2 | 2024-09-17 | An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned pac… |
CVE-2024-38813 | High | 7.5 | 2024-09-17 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to esc… |
CVE-2024-38812 | Critical | 9.8 | 2024-09-17 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server… |
CVE-2024-38380 | Medium | 5.5 | 2024-09-17 | This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbit… |
CVE-2024-8939 | Medium | 6.2 | 2024-09-17 | A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of… |
CVE-2024-8768 | High | 7.5 | 2024-09-17 | A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service. |
CVE-2024-7788 | High | 7.8 | 2024-09-17 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in Libr… |
CVE-2024-47049 | High | 8.2 | 2024-09-17 | The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, l… |
CVE-2024-47047 | High | 7.5 | 2024-09-17 | An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure… |
CVE-2024-38860 | Medium | 6.1 | 2024-09-17 | Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phishing attack… |
CVE-2024-22303 | High | 8.8 | 2024-09-17 | Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4. |
CVE-2024-21743 | High | 8.8 | 2024-09-17 | Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5. |
CVE-2024-8897 | Medium | 6.1 | 2024-09-17 | Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the a… |
CVE-2024-7873 | | 2024-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutral… | |
CVE-2024-46362 | High | 8.8 | 2024-09-17 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory |
CVE-2024-46085 | High | 8.8 | 2024-09-17 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename |
CVE-2024-5998 | High | 7.8 | 2024-09-17 | A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to th… |
CVE-2024-8767 | Critical | 9.9 | 2024-09-17 | Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WH… |
CVE-2024-8761 | High | 7.2 | 2024-09-17 | The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on… |
CVE-2024-8490 | High | 8.8 | 2024-09-17 | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incor… |
CVE-2024-8093 | Medium | 6.5 | 2024-09-17 | The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-8092 | Medium | 5.4 | 2024-09-17 | The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-8091 | Medium | 6.5 | 2024-09-17 | The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-8052 | Medium | 6.1 | 2024-09-17 | The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow att… |
CVE-2024-8051 | Medium | 5.4 | 2024-09-17 | The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-8047 | Medium | 6.5 | 2024-09-17 | The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8044 | Medium | 6.5 | 2024-09-17 | The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8043 | Medium | 5.4 | 2024-09-17 | The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-5170 | Medium | 4.8 | 2024-09-17 | The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as… |
CVE-2024-8110 | High | 7.5 | 2024-09-17 | Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. If a computer on which the affected product is installed receives… |
CVE-2024-7387 | Critical | 9.1 | 2024-09-17 | A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on… |
CVE-2024-45496 | Critical | 9.9 | 2024-09-17 | A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build… |
CVE-2024-44202 | Medium | 5.3 | 2024-09-17 | An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18. Private Browsing tabs may be acce… |
CVE-2024-44198 | Medium | 5.5 | 2024-09-17 | An integer overflow was addressed through improved input validation. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchO… |
CVE-2024-44191 | Medium | 5.5 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15… |
CVE-2024-44190 | Medium | 5.5 | 2024-09-17 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be abl… |
CVE-2024-44189 | High | 7.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. A logic issue existed where a process may be able to capture screen cont… |
CVE-2024-44188 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44187 | Medium | 6.5 | 2024-09-17 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 an… |
CVE-2024-44186 | Medium | 5.5 | 2024-09-17 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44184 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS… |
CVE-2024-44183 | Medium | 5.5 | 2024-09-17 | A logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma… |
CVE-2024-44182 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An a… |
CVE-2024-44181 | Medium | 5.5 | 2024-09-17 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be… |
CVE-2024-44180 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44178 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be ab… |
CVE-2024-44177 | Medium | 5.5 | 2024-09-17 | A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to… |
CVE-2024-44176 | Medium | 5.5 | 2024-09-17 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia… |
CVE-2024-44171 | Medium | 4.6 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with… |
CVE-2024-44170 | Medium | 5.5 | 2024-09-17 | A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, watchOS 11. An… |
CVE-2024-44169 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14… |
CVE-2024-44168 | Medium | 5.5 | 2024-09-17 | A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app ma… |
CVE-2024-44167 | Medium | 5.5 | 2024-09-17 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7… |
CVE-2024-44166 | Medium | 5.5 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 1… |
CVE-2024-44165 | High | 7.5 | 2024-09-17 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, m… |
CVE-2024-44164 | High | 7.1 | 2024-09-17 | This issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app… |
CVE-2024-44163 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A malicious application may be ab… |
CVE-2024-44162 | High | 7.8 | 2024-09-17 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items. |
CVE-2024-44161 | Medium | 5.5 | 2024-09-17 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a… |
CVE-2024-44160 | Medium | 5.5 | 2024-09-17 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing… |
CVE-2024-44158 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7… |
CVE-2024-44154 | Medium | 5.5 | 2024-09-17 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously… |
CVE-2024-44153 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access user-sensitiv… |
CVE-2024-44152 | High | 7.5 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to access user-… |
CVE-2024-44151 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be a… |
CVE-2024-44149 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-44148 | Critical | 10.0 | 2024-09-17 | This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
CVE-2024-44147 | Medium | 5.5 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An app may gain unauthorized access to Local Network. |
CVE-2024-44146 | Critical | 10.0 | 2024-09-17 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
CVE-2024-44139 | Low | 2.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from… |
CVE-2024-44135 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protec… |
CVE-2024-44134 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive locati… |
CVE-2024-44133 | Medium | 5.5 | 2024-09-17 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devices, an app may be able to bypass certain… |
CVE-2024-44132 | High | 8.8 | 2024-09-17 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
CVE-2024-44131 | Medium | 5.5 | 2024-09-17 | This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sens… |
CVE-2024-44130 | Medium | 4.4 | 2024-09-17 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15. An app with root privileges may be able to access private info… |
CVE-2024-44129 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Ventura 13.7. An app may be able to leak sensitive user informatio… |