2024 CVEs (page 180)
Page 180 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45159 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certifi… |
CVE-2024-45158 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the b… |
CVE-2024-45157 | Medium | 5.1 | 2024-09-05 | An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enablin… |
CVE-2024-7591 | Critical | 10.0 | 2024-09-05 | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All ve… |
CVE-2024-45401 | High | 7.5 | 2024-09-05 | stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3… |
CVE-2024-42491 | Medium | 5.7 | 2024-09-05 | Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of… |
CVE-2024-45392 | High | 7.7 | 2024-09-05 | SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat… |
CVE-2024-44728 | Medium | 6.1 | 2024-09-05 | Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/re… |
CVE-2024-44727 | Critical | 9.8 | 2024-09-05 | Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php. |
CVE-2024-24759 | Critical | 9.3 | 2024-09-05 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request… |
CVE-2024-45589 | Medium | 5.9 | 2024-09-05 | RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a d… |
CVE-2024-45176 | Medium | 6.1 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cr… |
CVE-2024-45175 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive informati… |
CVE-2024-45171 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for in… |
CVE-2024-45098 | Medium | 6.8 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. |
CVE-2024-45097 | Medium | 5.9 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. |
CVE-2024-45096 | Medium | 6.5 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing. |
CVE-2024-42885 | Critical | 9.1 | 2024-09-05 | SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page. |
CVE-2024-8445 | Medium | 5.7 | 2024-09-05 | The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash w… |
CVE-2024-45178 | High | 7.1 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from… |
CVE-2024-45173 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to… |
CVE-2024-44587 | High | 8.8 | 2024-09-05 | itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter. |
CVE-2024-8473 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8472 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8471 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8470 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php… |
CVE-2024-8469 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrie… |
CVE-2024-8468 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the… |
CVE-2024-8467 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrie… |
CVE-2024-8466 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php… |
CVE-2024-8465 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and… |
CVE-2024-8464 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.ph… |
CVE-2024-8463 | Critical | 9.9 | 2024-09-05 | File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via we… |
CVE-2024-8462 | Low | 3.7 | 2024-09-05 | A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/user… |
CVE-2024-8461 | Medium | 5.3 | 2024-09-05 | A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of t… |
CVE-2024-7884 | High | 7.5 | 2024-09-05 | When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internal… |
CVE-2024-8460 | Low | 3.7 | 2024-09-05 | A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-7605 | Medium | 4.3 | 2024-09-05 | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versio… |
CVE-2024-7381 | Medium | 5.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__short… |
CVE-2024-7380 | Medium | 4.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and a… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-6929 | Medium | 6.4 | 2024-09-05 | The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions up to, and includi… |
CVE-2024-6894 | Medium | 6.4 | 2024-09-05 | The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitiza… |
CVE-2024-6332 | Medium | 6.5 | 2024-09-05 | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing… |
CVE-2024-8363 | Medium | 6.4 | 2024-09-05 | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and includ… |
CVE-2024-5309 | Medium | 5.4 | 2024-09-05 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capabil… |
CVE-2024-45107 | Medium | 5.5 | 2024-09-05 | Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to di… |
CVE-2024-6835 | Medium | 5.3 | 2024-09-05 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_… |
CVE-2024-6846 | Medium | 5.3 | 2024-09-05 | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and ch… |
CVE-2024-8178 | High | 8.8 | 2024-09-05 | The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a gues… |
CVE-2024-45063 | High | 8.8 | 2024-09-05 | The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running… |
CVE-2024-43110 | High | 8.8 | 2024-09-05 | The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_sc… |
CVE-2024-43102 | Critical | 10.0 | 2024-09-05 | Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference c… |
CVE-2024-42416 | High | 8.8 | 2024-09-05 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kerne… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privile… |
CVE-2024-45288 | High | 8.4 | 2024-09-05 | A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2024-41928 | High | 8.4 | 2024-09-05 | Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically… |
CVE-2024-7627 | High | 8.1 | 2024-09-05 | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writin… |
CVE-2024-45692 | High | 7.5 | 2024-09-04 | Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000. |
CVE-2024-45429 | Medium | 6.1 | 2024-09-04 | Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an… |
CVE-2024-2166 | High | 8.8 | 2024-09-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) all… |
CVE-2024-20506 | Medium | 6.1 | 2024-09-04 | A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions… |
CVE-2024-20505 | Medium | 4.0 | 2024-09-04 | A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, al… |
CVE-2024-45395 | Low | 3.1 | 2024-09-04 | sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is pro… |
CVE-2024-45399 | Medium | 4.3 | 2024-09-04 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, correspondin… |
CVE-2024-45172 | Medium | 6.8 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerabl… |
CVE-2024-45008 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slo… |
CVE-2024-45007 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref… |
CVE-2024-45006 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating fu… |
CVE-2024-45005 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception issue when gisa is switched off We might run into a… |
CVE-2024-45004 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on l… |
CVE-2024-45003 | Medium | 4.7 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming proces… |
CVE-2024-45002 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool->data" allocation f… |
CVE-2024-45001 | High | 7.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix RX buf alloc_size alignment and atomic op panic The MANA driver's RX buffe… |
CVE-2024-45000 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: fs/netfs/fscache_cookie: add missing "n_accesses" check This fixes a NULL pointer derefer… |
CVE-2024-44999 | High | 7.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit-value in… |
CVE-2024-44998 | Critical | 9.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after ca… |
CVE-2024-44997 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When ther… |
CVE-2024-44996 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap… |
CVE-2024-44995 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix a deadlock problem when config TC during resetting When config TC during t… |
CVE-2024-44994 | High | 8.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault… |
CVE-2024-44993 | High | 7.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()` When enabling UBSAN on Raspberry P… |
CVE-2024-44992 | High | 7.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid possible NULL dereference in cifs_free_subrequest() Clang static checke… |
CVE-2024-44991 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: tcp: prevent concurrent execution of tcp_sk_exit_batch Its possible that two threads call… |
CVE-2024-44990 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an act… |
CVE-2024-44989 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL bec… |
CVE-2024-44988 | High | 8.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load… |
CVE-2024-44987 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After i… |
CVE-2024-44986 | High | 8.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has… |
CVE-2024-44985 | Critical | 9.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been… |
CVE-2024-44984 | Critical | 10.0 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT Remove the dma_unmap_page_attrs() call… |
CVE-2024-44983 | High | 7.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the… |
CVE-2024-44982 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_la… |
CVE-2024-44981 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() UBSAN reports the f… |
CVE-2024-44980 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix opregion leak Being part o the display, ideally the setup and cleanup would b… |
CVE-2024-44979 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xe_gt_pagefault On driver reload we never free u… |
CVE-2024-44978 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xe_exec_queue_put Free job depends on job->vm being valid, the la… |
CVE-2024-44977 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. (c… |