2024 CVEs (page 173)
Page 173 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-5884 | Medium | 6.4 | 2024-09-13 | The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4… |
CVE-2024-5870 | Medium | 6.4 | 2024-09-13 | The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to… |
CVE-2024-5869 | Medium | 6.4 | 2024-09-13 | The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up… |
CVE-2024-5867 | Medium | 6.4 | 2024-09-13 | The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up t… |
CVE-2024-5789 | Medium | 6.4 | 2024-09-13 | The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up… |
CVE-2024-46713 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly in… |
CVE-2024-46049 | Critical | 9.8 | 2024-09-13 | Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function. |
CVE-2024-46048 | Critical | 9.8 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i |
CVE-2024-46047 | High | 7.5 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function. |
CVE-2024-46046 | Critical | 9.8 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function. |
CVE-2024-46045 | Critical | 9.8 | 2024-09-13 | Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. |
CVE-2024-46044 | Critical | 9.8 | 2024-09-13 | CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. |
CVE-2024-45113 | High | 7.5 | 2024-09-13 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker… |
CVE-2024-45109 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-45108 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-43760 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-43756 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution i… |
CVE-2024-41874 | Critical | 9.8 | 2024-09-13 | ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution… |
CVE-2024-6656 | Critical | 9.8 | 2024-09-13 | Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. This issue affects Co… |
CVE-2024-45112 | High | 7.8 | 2024-09-13 | Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in… |
CVE-2024-45111 | Medium | 5.5 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacke… |
CVE-2024-43759 | Medium | 5.5 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS… |
CVE-2024-43758 | High | 7.8 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2024-41869 | High | 7.8 | 2024-09-13 | Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in… |
CVE-2024-41867 | Medium | 5.5 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-41859 | High | 7.8 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2024-41857 | High | 7.8 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execu… |
CVE-2024-39385 | Medium | 5.5 | 2024-09-13 | Premiere Pro versions 24.5, 23.6.8 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2024-39384 | High | 7.8 | 2024-09-13 | Premiere Pro versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the contex… |
CVE-2024-39382 | Medium | 5.5 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-39381 | High | 7.8 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2024-39380 | High | 7.8 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2024-34121 | High | 7.8 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in… |
CVE-2024-8742 | Medium | 6.4 | 2024-09-13 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-8665 | Medium | 6.1 | 2024-09-13 | The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-8664 | Medium | 6.1 | 2024-09-13 | The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8663 | Medium | 6.1 | 2024-09-13 | The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without… |
CVE-2024-7888 | Medium | 6.3 | 2024-09-13 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-5567 | Medium | 6.4 | 2024-09-13 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insuffici… |
CVE-2024-46712 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if… |
CVE-2024-46711 | Medium | 4.7 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix ID 0 endp usage after multiple re-creations 'local_addr_used' and 'add_add… |
CVE-2024-46710 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Prevent unmapping active read buffers The kms paths keep a persistent map act… |
CVE-2024-46709 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix prime with external buffers Make sure that for external buffers mapping g… |
CVE-2024-46708 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: x1e80100: Fix special pin offsets Remove the erroneus 0x100000 offset to p… |
CVE-2024-46707 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3… |
CVE-2024-46706 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: mark last busy before uart_add_one_port With "earlycon initcall_… |
CVE-2024-46705 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: reset mmio mappings with devm Set our various mmio mappings to NULL. This should… |
CVE-2024-46704 | Medium | 4.7 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix spruious data race in __flush_work() When flushing a work item for cancell… |
CVE-2024-46703 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" This re… |
CVE-2024-46702 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do d… |
CVE-2024-46701 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations f… |
CVE-2024-41873 | Medium | 5.5 | 2024-09-13 | Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-41872 | Medium | 5.5 | 2024-09-13 | Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-41871 | Medium | 5.5 | 2024-09-13 | Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-41870 | Medium | 5.5 | 2024-09-13 | Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-39377 | High | 7.8 | 2024-09-13 | Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2024-7864 | Medium | 6.5 | 2024-09-13 | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers… |
CVE-2024-7863 | Medium | 6.8 | 2024-09-13 | The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to… |
CVE-2024-7133 | Medium | 4.8 | 2024-09-13 | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and esca… |
CVE-2024-7129 | High | 7.2 | 2024-09-13 | The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection w… |
CVE-2024-6850 | Medium | 4.8 | 2024-09-13 | The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to… |
CVE-2024-6723 | Medium | 4.7 | 2024-09-13 | The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection ex… |
CVE-2024-6617 | Medium | 4.8 | 2024-09-13 | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-6493 | Medium | 4.8 | 2024-09-13 | The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-5628 | Medium | 6.4 | 2024-09-13 | The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcod… |
CVE-2024-46699 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption arou… |
CVE-2024-46698 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflic… |
CVE-2024-46697 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up d… |
CVE-2024-46696 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference… |
CVE-2024-46695 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko report… |
CVE-2024-46694 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid using null object of framebuffer Instead of using state->fb->obj[0… |
CVE-2024-46693 | Medium | 4.7 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink: Fix race during initialization As pointed out by Stephen Boyd it i… |
CVE-2024-46692 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Mark get_wq_ctx() as atomic call Currently get_wq_ctx() is wrongly c… |
CVE-2024-46691 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Move unregister out of atomic section Commit '9329933699b3 ("soc: qcom… |
CVE-2024-46690 | Critical | 9.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to… |
CVE-2024-46689 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db regio… |
CVE-2024-46688 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails If z_erofs_gb… |
CVE-2024-46687 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() [BUG] There i… |
CVE-2024-46686 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() This happens when calle… |
CVE-2024-46685 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcs_get_function() pinmux_generic_get_… |
CVE-2024-46684 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined create_elf_fdpic_t… |
CVE-2024-46683 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: prevent UAF around preempt fence The fence lock is part of the queue, therefore i… |
CVE-2024-46682 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Prior to commit 3f29cc82a8… |
CVE-2024-46681 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: pktgen: use cpus_read_lock() in pg_net_init() I have seen the WARN_ON(smp_processor_id()… |
CVE-2024-46680 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix random crash seen while removing driver This fixes the random k… |
CVE-2024-46679 | Medium | 4.7 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with… |
CVE-2024-46678 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock… |
CVE-2024-46677 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfd_lookup() fails, gtp_encap_enabl… |
CVE-2024-46676 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 and tm_pro… |
CVE-2024-46675 | Medium | 5.5 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: Prevent USB core invalid event buffer address access This commit address… |
CVE-2024-46674 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path The probe functio… |
CVE-2024-46673 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific i… |
CVE-2024-38816 | High | 7.5 | 2024-09-13 | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can c… |
CVE-2024-8656 | Medium | 6.1 | 2024-09-13 | The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the U… |
CVE-2024-43180 | Medium | 4.3 | 2024-09-13 | IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2024-8762 | Medium | 6.3 | 2024-09-13 | A vulnerability was found in code-projects Crud Operation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatedata… |
CVE-2024-8751 | High | 7.5 | 2024-09-12 | A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service… |
CVE-2024-7961 | Critical | 9.8 | 2024-09-12 | A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server t… |
CVE-2024-7960 | Critical | 9.1 | 2024-09-12 | The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerabili… |