2024 CVEs (page 176)
Page 176 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21529 | High | 8.2 | 2024-09-11 | Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability… |
CVE-2024-1656 | Low | 2.6 | 2024-09-11 | Affected versions of Octopus Server had a weak content security policy. |
CVE-2024-8253 | High | 8.8 | 2024-09-11 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not p… |
CVE-2024-39808 | Medium | 4.6 | 2024-09-11 | Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Con… |
CVE-2024-24972 | Medium | 6.5 | 2024-09-11 | Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated… |
CVE-2024-23906 | Medium | 6.1 | 2024-09-11 | Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify… |
CVE-2024-40662 | High | 7.8 | 2024-09-11 | In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privile… |
CVE-2024-40659 | Medium | 5.5 | 2024-09-11 | In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the… |
CVE-2024-40658 | High | 7.8 | 2024-09-11 | In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of… |
CVE-2024-40657 | High | 7.8 | 2024-09-11 | In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead… |
CVE-2024-40656 | Medium | 5.5 | 2024-09-11 | In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could… |
CVE-2024-40655 | High | 7.8 | 2024-09-11 | In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a pe… |
CVE-2024-40654 | High | 7.8 | 2024-09-11 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-40652 | High | 7.8 | 2024-09-11 | In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission c… |
CVE-2024-40650 | High | 7.8 | 2024-09-11 | In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege w… |
CVE-2024-31336 | High | 7.8 | 2024-09-11 | In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local… |
CVE-2024-23716 | High | 7.0 | 2024-09-11 | In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the… |
CVE-2024-45597 | Medium | 5.3 | 2024-09-10 | Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected… |
CVE-2024-8441 | Medium | 6.7 | 2024-09-10 | An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privilege… |
CVE-2024-8322 | Medium | 4.3 | 2024-09-10 | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted… |
CVE-2024-8321 | Medium | 5.8 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate man… |
CVE-2024-8320 | Medium | 5.3 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Netwo… |
CVE-2024-8191 | High | 7.8 | 2024-09-10 | SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote… |
CVE-2024-8190 | High | 7.2 | 2024-09-10 | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain rem… |
CVE-2024-8012 | High | 7.8 | 2024-09-10 | An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated atta… |
CVE-2024-44107 | High | 8.8 | 2024-09-10 | DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their p… |
CVE-2024-44106 | High | 8.8 | 2024-09-10 | Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker… |
CVE-2024-44105 | High | 8.2 | 2024-09-10 | Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authent… |
CVE-2024-44104 | High | 8.8 | 2024-09-10 | An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 20… |
CVE-2024-44103 | High | 8.8 | 2024-09-10 | DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their p… |
CVE-2024-8655 | Medium | 5.3 | 2024-09-10 | A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The… |
CVE-2024-8504 | High | 8.8 | 2024-09-10 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-20… |
CVE-2024-8503 | Critical | 9.8 | 2024-09-10 | An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaint… |
CVE-2024-8232 | High | 7.5 | 2024-09-10 | SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication. |
CVE-2024-43040 | Critical | 9.1 | 2024-09-10 | Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid parameter at /fx/baseinfo/… |
CVE-2024-45596 | High | 7.4 | 2024-09-10 | Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via… |
CVE-2024-45409 | Critical | 10.0 | 2024-09-10 | The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signa… |
CVE-2024-34831 | Medium | 6.1 | 2024-09-10 | cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage… |
CVE-2024-44893 | Critical | 9.8 | 2024-09-10 | An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request. |
CVE-2024-44872 | Medium | 6.1 | 2024-09-10 | A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user's browser via inject… |
CVE-2024-44871 | High | 7.2 | 2024-09-10 | An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted f… |
CVE-2024-44667 | High | 8.0 | 2024-09-10 | Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. Unauthenticated… |
CVE-2024-43495 | High | 7.3 | 2024-09-10 | Windows libarchive Remote Code Execution Vulnerability |
CVE-2024-43492 | High | 7.8 | 2024-09-10 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2024-43491 | Critical | 9.8 | 2024-09-10 | Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, v… |
CVE-2024-43487 | Medium | 6.5 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-43482 | Medium | 6.5 | 2024-09-10 | Microsoft Outlook for iOS Information Disclosure Vulnerability |
CVE-2024-43479 | High | 8.5 | 2024-09-10 | Microsoft Power Automate Desktop Remote Code Execution Vulnerability |
CVE-2024-43476 | High | 7.6 | 2024-09-10 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2024-43475 | High | 7.3 | 2024-09-10 | Microsoft Windows Admin Center Information Disclosure Vulnerability |
CVE-2024-43474 | High | 7.6 | 2024-09-10 | Microsoft SQL Server Information Disclosure Vulnerability |
CVE-2024-43470 | High | 7.3 | 2024-09-10 | Azure Network Watcher VM Agent Elevation of Privilege Vulnerability |
CVE-2024-43469 | High | 8.8 | 2024-09-10 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-43467 | High | 7.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-43466 | Medium | 6.5 | 2024-09-10 | Microsoft SharePoint Server Denial of Service Vulnerability |
CVE-2024-43465 | High | 7.8 | 2024-09-10 | Microsoft Excel Elevation of Privilege Vulnerability |
CVE-2024-43464 | High | 7.2 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-43463 | High | 7.8 | 2024-09-10 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2024-43461 | High | 8.8 | 2024-09-10 | Windows MSHTML Platform Spoofing Vulnerability |
CVE-2024-43458 | High | 7.7 | 2024-09-10 | Windows Networking Information Disclosure Vulnerability |
CVE-2024-43457 | High | 7.8 | 2024-09-10 | Windows Setup and Deployment Elevation of Privilege Vulnerability |
CVE-2024-43455 | High | 8.8 | 2024-09-10 | Windows Remote Desktop Licensing Service Spoofing Vulnerability |
CVE-2024-43454 | High | 7.1 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-38263 | High | 7.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-38260 | High | 8.8 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-38259 | High | 8.8 | 2024-09-10 | Microsoft Management Console Remote Code Execution Vulnerability |
CVE-2024-38258 | Medium | 6.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Information Disclosure Vulnerability |
CVE-2024-38257 | High | 7.5 | 2024-09-10 | Microsoft AllJoyn API Information Disclosure Vulnerability |
CVE-2024-38256 | Medium | 5.5 | 2024-09-10 | Windows Kernel-Mode Driver Information Disclosure Vulnerability |
CVE-2024-38254 | Medium | 5.5 | 2024-09-10 | Windows Authentication Information Disclosure Vulnerability |
CVE-2024-38253 | High | 7.8 | 2024-09-10 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
CVE-2024-38252 | High | 7.8 | 2024-09-10 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
CVE-2024-38250 | High | 7.8 | 2024-09-10 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2024-38249 | High | 7.8 | 2024-09-10 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2024-38248 | High | 7.0 | 2024-09-10 | Windows Storage Elevation of Privilege Vulnerability |
CVE-2024-38247 | High | 7.8 | 2024-09-10 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2024-38246 | High | 7.0 | 2024-09-10 | Win32k Elevation of Privilege Vulnerability |
CVE-2024-38245 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38244 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38243 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38242 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38241 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38240 | High | 8.1 | 2024-09-10 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
CVE-2024-38239 | High | 7.2 | 2024-09-10 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2024-38238 | High | 7.8 | 2024-09-10 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38237 | High | 7.8 | 2024-09-10 | Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability |
CVE-2024-38236 | High | 7.5 | 2024-09-10 | DHCP Server Service Denial of Service Vulnerability |
CVE-2024-38235 | Medium | 6.5 | 2024-09-10 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-38234 | Medium | 6.5 | 2024-09-10 | Windows Networking Denial of Service Vulnerability |
CVE-2024-38233 | High | 7.5 | 2024-09-10 | Windows Networking Denial of Service Vulnerability |
CVE-2024-38232 | High | 7.5 | 2024-09-10 | Windows Networking Denial of Service Vulnerability |
CVE-2024-38231 | Medium | 6.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Denial of Service Vulnerability |
CVE-2024-38230 | Medium | 6.5 | 2024-09-10 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
CVE-2024-38228 | High | 7.2 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-38227 | High | 7.2 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-38226 | High | 7.3 | 2024-09-10 | Microsoft Publisher Security Feature Bypass Vulnerability |
CVE-2024-38225 | High | 8.8 | 2024-09-10 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2024-38220 | Critical | 9.0 | 2024-09-10 | Azure Stack Hub Elevation of Privilege Vulnerability |
CVE-2024-38217 | Medium | 5.4 | 2024-09-10 | Windows Mark of the Web Security Feature Bypass Vulnerability |
CVE-2024-38216 | High | 8.2 | 2024-09-10 | Azure Stack Hub Elevation of Privilege Vulnerability |