2024 CVEs (page 177)
Page 177 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38194 | High | 8.4 | 2024-09-10 | An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network. |
CVE-2024-38188 | High | 7.1 | 2024-09-10 | Azure Network Watcher VM Agent Elevation of Privilege Vulnerability |
CVE-2024-38119 | High | 7.5 | 2024-09-10 | Windows Network Address Translation (NAT) Remote Code Execution Vulnerability |
CVE-2024-38046 | High | 7.8 | 2024-09-10 | PowerShell Elevation of Privilege Vulnerability |
CVE-2024-38045 | High | 8.1 | 2024-09-10 | Windows TCP/IP Remote Code Execution Vulnerability |
CVE-2024-38018 | High | 8.8 | 2024-09-10 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-38014 | High | 7.8 | 2024-09-10 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-37980 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2024-37966 | High | 7.1 | 2024-09-10 | Microsoft SQL Server Native Scoring Information Disclosure Vulnerability |
CVE-2024-37965 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2024-37342 | High | 7.1 | 2024-09-10 | Microsoft SQL Server Native Scoring Information Disclosure Vulnerability |
CVE-2024-37341 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Elevation of Privilege Vulnerability |
CVE-2024-37340 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-37339 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-37338 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-37337 | High | 7.1 | 2024-09-10 | Microsoft SQL Server Native Scoring Information Disclosure Vulnerability |
CVE-2024-37335 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-30073 | High | 7.8 | 2024-09-10 | Windows Security Zone Mapping Security Feature Bypass Vulnerability |
CVE-2024-26191 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-26186 | High | 8.8 | 2024-09-10 | Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability |
CVE-2024-21416 | High | 8.1 | 2024-09-10 | Windows TCP/IP Remote Code Execution Vulnerability |
CVE-2024-6876 | Medium | 4.4 | 2024-09-10 | Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a c… |
CVE-2024-45595 | Medium | 6.1 | 2024-09-10 | D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious… |
CVE-2024-45593 | Critical | 9.0 | 2024-09-10 | Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when u… |
CVE-2024-45592 | High | 8.2 | 2024-09-10 | auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unesca… |
CVE-2024-45591 | Medium | 5.3 | 2024-09-10 | XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information… |
CVE-2024-45590 | High | 7.5 | 2024-09-10 | body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a… |
CVE-2024-45412 | Medium | 5.3 | 2024-09-10 | Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach… |
CVE-2024-45407 | Medium | 6.5 | 2024-09-10 | Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an… |
CVE-2024-44815 | Medium | 4.6 | 2024-09-10 | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV. |
CVE-2024-44677 | Critical | 9.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java… |
CVE-2024-44676 | Medium | 4.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController. java. |
CVE-2024-31960 | High | 7.8 | 2024-09-10 | An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. The xclipse amdgpu driver has a reference count bug. This can lead to a use after… |
CVE-2024-45393 | Medium | 6.4 | 2024-09-10 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhoo… |
CVE-2024-45323 | Medium | 4.3 | 2024-09-10 | An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an a… |
CVE-2024-45044 | High | 8.8 | 2024-09-10 | Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command… |
CVE-2024-43800 | Medium | 5.0 | 2024-09-10 | serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is… |
CVE-2024-43799 | Medium | 5.0 | 2024-09-10 | Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrust… |
CVE-2024-43796 | Medium | 5.0 | 2024-09-10 | Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute… |
CVE-2024-42423 | Medium | 6.1 | 2024-09-10 | Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local… |
CVE-2024-36511 | Low | 3.7 | 2024-09-10 | An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions… |
CVE-2024-35282 | Medium | 4.2 | 2024-09-10 | A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versio… |
CVE-2024-33508 | High | 7.3 | 2024-09-10 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7… |
CVE-2024-31490 | Medium | 4.3 | 2024-09-10 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, For… |
CVE-2024-31489 | Medium | 6.8 | 2024-09-10 | AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 thr… |
CVE-2024-27257 | Medium | 4.3 | 2024-09-10 | IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users. |
CVE-2024-25074 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-25073 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-23185 | High | 7.5 | 2024-09-10 | Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when… |
CVE-2024-23184 | Medium | 5.0 | 2024-09-10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, a… |
CVE-2024-21753 | Medium | 5.5 | 2024-09-10 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13… |
CVE-2024-8654 | Medium | 5.0 | 2024-09-10 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This i… |
CVE-2024-8443 | Low | 2.9 | 2024-09-10 | A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs… |
CVE-2024-44867 | High | 7.5 | 2024-09-10 | phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. |
CVE-2024-37728 | High | 7.5 | 2024-09-10 | Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensit… |
CVE-2024-8369 | Medium | 5.3 | 2024-09-10 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to… |
CVE-2024-6282 | Medium | 5.4 | 2024-09-10 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-7770 | High | 8.8 | 2024-09-10 | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to m… |
CVE-2024-40754 | Critical | 9.8 | 2024-09-10 | Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0. |
CVE-2024-8645 | Medium | 5.5 | 2024-09-10 | SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file |
CVE-2024-8543 | Medium | 6.4 | 2024-09-10 | The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versio… |
CVE-2024-8241 | Medium | 6.4 | 2024-09-10 | The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block… |
CVE-2024-45032 | Critical | 10.0 | 2024-09-10 | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Af… |
CVE-2024-44087 | High | 8.6 | 2024-09-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automatio… |
CVE-2024-43781 | Medium | 5.5 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Cr… |
CVE-2024-43647 | High | 7.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-42345 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session e… |
CVE-2024-42344 | Medium | 4.4 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application inserts sensitive information into a lo… |
CVE-2024-41171 | High | 8.8 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMER… |
CVE-2024-41170 | High | 7.8 | 2024-09-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2024-37995 | Low | 2.7 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37994 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37993 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37992 | Medium | 4.9 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37991 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37990 | Medium | 6.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-35783 | Critical | 9.1 | 2024-09-10 | A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Informat… |
CVE-2024-33698 | Critical | 9.8 | 2024-09-10 | A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMA… |
CVE-2024-32006 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the user session on reb… |
CVE-2024-8258 | High | 7.8 | 2024-09-10 | Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute a… |
CVE-2024-7699 | High | 8.8 | 2024-09-10 | An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-43393 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43392 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43391 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43390 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP enviro… |
CVE-2024-43389 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment… |
CVE-2024-43388 | High | 8.8 | 2024-09-10 | A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. |
CVE-2024-43387 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mG… |
CVE-2024-43386 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-43385 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-42425 | Low | 3.8 | 2024-09-10 | Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacke… |
CVE-2024-39583 | High | 8.1 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit… |
CVE-2024-39582 | Low | 2.3 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially e… |
CVE-2024-39581 | High | 7.3 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker w… |
CVE-2024-39580 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could pote… |
CVE-2024-39574 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially… |
CVE-2024-7734 | Medium | 5.3 | 2024-09-10 | An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the… |
CVE-2024-7655 | Medium | 4.4 | 2024-09-10 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers… |
CVE-2024-7618 | Medium | 4.4 | 2024-09-10 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘co… |