2024 CVEs (page 171)
Page 171 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40826 | Medium | 6.1 | 2024-09-17 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An unencrypted document may be wr… |
CVE-2024-40825 | Medium | 4.4 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with root privileges may be able to modify t… |
CVE-2024-40801 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protec… |
CVE-2024-40797 | Medium | 6.1 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Visiting a maliciou… |
CVE-2024-40791 | Low | 3.3 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macO… |
CVE-2024-40790 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved handling of caches. This issue is fixed in visionOS 2. An app may be able to read sensitive data from the GPU memory. |
CVE-2024-40770 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted… |
CVE-2024-27880 | Medium | 5.5 | 2024-09-17 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia… |
CVE-2024-27879 | High | 7.5 | 2024-09-17 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. An attacker may be able to cause un… |
CVE-2024-27876 | Medium | 5.5 | 2024-09-17 | A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14… |
CVE-2024-27875 | Medium | 5.5 | 2024-09-17 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15. Privacy Indicators for microphone or camera access may be… |
CVE-2024-27874 | High | 7.5 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A remote attacker may be able to cause a denial-of-ser… |
CVE-2024-27869 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an… |
CVE-2024-27861 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory. |
CVE-2024-27860 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory. |
CVE-2024-27858 | Medium | 5.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data. |
CVE-2024-27795 | High | 7.5 | 2024-09-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet. |
CVE-2024-23237 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause a denial-of-service. |
CVE-2024-6685 | Low | 3.1 | 2024-09-16 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group… |
CVE-2024-4283 | Medium | 6.4 | 2024-09-16 | An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain co… |
CVE-2024-45416 | High | 8.1 | 2024-09-16 | The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory… |
CVE-2024-45415 | Critical | 9.8 | 2024-09-16 | The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for val… |
CVE-2024-45414 | Critical | 9.8 | 2024-09-16 | The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decryp… |
CVE-2024-45413 | High | 8.1 | 2024-09-16 | The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to de… |
CVE-2024-8766 | Medium | 6.7 | 2024-09-16 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38… |
CVE-2024-45800 | Medium | 5.0 | 2024-09-16 | Snappymail is an open source web-based email client. SnappyMail uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the… |
CVE-2024-42798 | High | 7.6 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System… |
CVE-2024-42796 | Medium | 5.9 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows… |
CVE-2024-42795 | Medium | 4.2 | 2024-09-16 | An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management Sy… |
CVE-2024-42794 | Medium | 4.7 | 2024-09-16 | Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user. |
CVE-2024-34016 | Medium | 6.5 | 2024-09-16 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38… |
CVE-2024-22013 | Medium | 5.3 | 2024-09-16 | U-Boot environment is read from unauthenticated partition. |
CVE-2024-45801 | High | 7.3 | 2024-09-16 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting tec… |
CVE-2024-45799 | High | 7.3 | 2024-09-16 | FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that a… |
CVE-2024-39910 | Medium | 5.4 | 2024-09-16 | decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is sub… |
CVE-2024-32034 | Medium | 6.8 | 2024-09-16 | decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to po… |
CVE-2024-8661 | Medium | 4.8 | 2024-09-16 | Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a maliciou… |
CVE-2024-36261 | Low | 3.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent… |
CVE-2024-36247 | Medium | 4.6 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access. |
CVE-2024-34545 | Medium | 5.2 | 2024-09-16 | Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable information disclosure… |
CVE-2024-34543 | Medium | 6.7 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2024-34153 | Medium | 6.7 | 2024-09-16 | Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of pri… |
CVE-2024-33848 | Medium | 6.5 | 2024-09-16 | Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2024-32940 | Medium | 6.5 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adja… |
CVE-2024-32666 | Medium | 4.7 | 2024-09-16 | NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via loc… |
CVE-2024-28170 | Low | 3.3 | 2024-09-16 | Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2024-24968 | Medium | 5.3 | 2024-09-16 | Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via… |
CVE-2024-23984 | Medium | 5.3 | 2024-09-16 | Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2024-23599 | High | 7.9 | 2024-09-16 | Race condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial of service via local… |
CVE-2024-21871 | High | 7.5 | 2024-09-16 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2024-21829 | High | 7.5 | 2024-09-16 | Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege… |
CVE-2024-21781 | High | 7.2 | 2024-09-16 | Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or denial of service via l… |
CVE-2024-8752 | High | 7.5 | 2024-09-16 | The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system. |
CVE-2024-44623 | Critical | 9.8 | 2024-09-16 | An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function. |
CVE-2024-7104 | Critical | 9.8 | 2024-09-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: bef… |
CVE-2024-7098 | Critical | 9.8 | 2024-09-16 | Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4… |
CVE-2024-6401 | Critical | 9.8 | 2024-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection. This iss… |
CVE-2024-45835 | Low | 2.5 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other miscon… |
CVE-2024-39772 | Low | 3.7 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots vi… |
CVE-2024-38315 | Medium | 6.3 | 2024-09-16 | IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user… |
CVE-2024-46419 | Critical | 9.8 | 2024-09-16 | TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter. |
CVE-2024-46937 | High | 7.5 | 2024-09-16 | An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x t… |
CVE-2024-46451 | Critical | 9.8 | 2024-09-16 | TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter. |
CVE-2024-46424 | High | 7.5 | 2024-09-16 | TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of S… |
CVE-2024-22399 | Critical | 9.8 | 2024-09-16 | Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client S… |
CVE-2024-46970 | Low | 3.3 | 2024-09-16 | In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible |
CVE-2024-45833 | Medium | 4.5 | 2024-09-16 | Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the… |
CVE-2024-45698 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-code… |
CVE-2024-45697 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote… |
CVE-2024-45696 | High | 8.8 | 2024-09-16 | Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the te… |
CVE-2024-45695 | Critical | 9.8 | 2024-09-16 | The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attacker… |
CVE-2024-45694 | Critical | 9.8 | 2024-09-16 | The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attacker… |
CVE-2024-39613 | Medium | 5.3 | 2024-09-16 | Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an… |
CVE-2024-1578 | Medium | 5.3 | 2024-09-16 | The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters rando… |
CVE-2024-8780 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to o… |
CVE-2024-8779 | High | 8.8 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privil… |
CVE-2024-8778 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arb… |
CVE-2024-8777 | High | 7.5 | 2024-09-16 | OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP… |
CVE-2024-8776 | Medium | 6.1 | 2024-09-16 | SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript code to the paramet… |
CVE-2024-46958 | Critical | 9.1 | 2024-09-16 | In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. Thi… |
CVE-2024-8880 | Medium | 5.6 | 2024-09-16 | A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=ma… |
CVE-2024-46943 | High | 7.5 | 2024-09-15 | An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate… |
CVE-2024-46942 | Medium | 6.5 | 2024-09-15 | In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight… |
CVE-2024-8876 | Medium | 4.3 | 2024-09-15 | A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality… |
CVE-2024-8875 | Medium | 5.4 | 2024-09-15 | A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder… |
CVE-2024-46938 | High | 7.5 | 2024-09-15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re… |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-8869 | Medium | 5.0 | 2024-09-15 | A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command inject… |
CVE-2024-44059 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapp… |
CVE-2024-44058 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This is… |
CVE-2024-44057 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This iss… |
CVE-2024-44056 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issu… |
CVE-2024-44054 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issu… |
CVE-2024-44053 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This… |
CVE-2024-45460 | Medium | 5.9 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.T… |
CVE-2024-45459 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-pr… |
CVE-2024-45458 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Ref… |
CVE-2024-45457 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Sto… |
CVE-2024-45456 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |
CVE-2024-45455 | Medium | 5.9 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |