2024 CVEs (page 181)
Page 181 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44976 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: ata: pata_macio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit Pow… |
CVE-2024-44975 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmd_update We find a bug as below: BUG: unable to… |
CVE-2024-44974 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signa… |
CVE-2024-42642 | Medium | 6.7 | 2024-09-04 | Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from t… |
CVE-2024-44973 | High | 8.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfenc… |
CVE-2024-44971 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf2_mdio_reg… |
CVE-2024-44970 | Critical | 9.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have b… |
CVE-2024-44969 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion of a Store… |
CVE-2024-44968 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for ma… |
CVE-2024-44967 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_rese… |
CVE-2024-44966 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_f… |
CVE-2024-44965 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an… |
CVE-2024-44964 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit… |
CVE-2024-44963 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at… |
CVE-2024-44962 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unlo… |
CVE-2024-44961 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft rec… |
CVE-2024-44960 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set befor… |
CVE-2024-44959 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: tracefs: Use generic inode RCU for synchronizing freeing With structure layout randomizat… |
CVE-2024-44958 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while… |
CVE-2024-44957 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Switch from mutex to spinlock for irqfds irqfd_wakeup() gets EPOLLHUP, when… |
CVE-2024-44956 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/preempt_fence: enlarge the fence critical section It is really easy to introduce s… |
CVE-2024-44954 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf… |
CVE-2024-44953 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix deadlock during RTC update There is a deadlock when runtime suspend… |
CVE-2024-44951 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel… |
CVE-2024-44950 | High | 7.1 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access… |
CVE-2024-44949 | High | 7.8 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too s… |
CVE-2024-44948 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed vari… |
CVE-2024-8417 | Low | 3.1 | 2024-09-04 | A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of… |
CVE-2024-8416 | Medium | 6.3 | 2024-09-04 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2024-45177 | Medium | 5.4 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to… |
CVE-2024-8415 | Medium | 6.3 | 2024-09-04 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-8414 | Medium | 4.3 | 2024-09-04 | A vulnerability has been found in SourceCodester Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2024-45174 | High | 8.1 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalitie… |
CVE-2024-45170 | High | 8.1 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative… |
CVE-2024-20503 | Medium | 5.5 | 2024-09-04 | A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system… |
CVE-2024-20497 | Medium | 4.3 | 2024-09-04 | A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system. T… |
CVE-2024-20469 | Medium | 6.0 | 2024-09-04 | A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection atta… |
CVE-2024-20440 | High | 7.5 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due… |
CVE-2024-20439 | Critical | 9.8 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static admini… |
CVE-2024-8412 | Medium | 4.3 | 2024-09-04 | A vulnerability, which was classified as problematic, was found in LinuxOSsk Shakal-NG up to 1.3.3. Affected is an unknown function of the file comments/views… |
CVE-2024-8391 | High | 7.5 | 2024-09-04 | In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.ve… |
CVE-2024-45314 | Low | 3.6 | 2024-09-04 | Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally sto… |
CVE-2024-45076 | Critical | 9.9 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating sy… |
CVE-2024-45075 | High | 8.8 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrato… |
CVE-2024-45074 | Medium | 6.5 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2024-45053 | Critical | 9.1 | 2024-09-04 | Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without… |
CVE-2024-45052 | Medium | 5.3 | 2024-09-04 | Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver auth… |
CVE-2024-45050 | High | 7.1 | 2024-09-04 | Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server do… |
CVE-2024-44859 | High | 8.0 | 2024-09-04 | Tenda FH1201 v1.2.0.14 has a stack buffer overflow vulnerability in `formWrlExtraGet`. |
CVE-2024-44821 | Medium | 5.3 | 2024-09-04 | ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value… |
CVE-2024-44818 | Medium | 5.4 | 2024-09-04 | Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP_Referer header of the caina… |
CVE-2024-44817 | High | 8.8 | 2024-09-04 | SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the adv2.php component. |
CVE-2024-44808 | Critical | 9.8 | 2024-09-04 | An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter. |
CVE-2024-43405 | High | 7.4 | 2024-09-04 | Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template s… |
CVE-2024-43402 | High | 8.1 | 2024-09-04 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, w… |
CVE-2024-8418 | High | 7.5 | 2024-09-04 | A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit th… |
CVE-2024-8411 | Low | 3.5 | 2024-09-04 | A vulnerability was determined in ABCD ABCD2 up to 2.2.0-beta-1. Impacted is an unknown function of the file /buscar_integrada.php. Executing a manipulation of… |
CVE-2024-8410 | Medium | 4.3 | 2024-09-04 | A vulnerability classified as problematic was found in ABCD ABCD2 up to 2.2.0-beta-1. This vulnerability affects unknown code of the file /abcd/opac/php/otros_… |
CVE-2024-8409 | Medium | 4.3 | 2024-09-04 | A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/show_image.php. The… |
CVE-2024-7078 | Critical | 9.8 | 2024-09-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos… |
CVE-2024-7077 | Medium | 6.1 | 2024-09-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos… |
CVE-2024-7076 | Critical | 9.8 | 2024-09-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos… |
CVE-2024-45506 | High | 7.5 | 2024-09-04 | HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) un… |
CVE-2024-44820 | Medium | 6.1 | 2024-09-04 | A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/. When accessed wit… |
CVE-2024-44819 | Medium | 6.1 | 2024-09-04 | Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename par… |
CVE-2024-8408 | Medium | 6.3 | 2024-09-04 | A vulnerability was found in Linksys WRT54G 4.21.5. It has been rated as critical. Affected by this issue is the function validate_services_port of the file /a… |
CVE-2024-8407 | Low | 3.5 | 2024-09-04 | A vulnerability was found in alwindoss akademy up to 35caccea888ed63d5489e211c99edff1f62efdba. It has been declared as problematic. Affected by this vulnerabil… |
CVE-2024-7923 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configura… |
CVE-2024-7012 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This… |
CVE-2024-7834 | High | 7.8 | 2024-09-04 | A local privilege escalation is caused by Overwolf loading and executing certain dynamic link library files from a user-writeable folder in SYSTEM context on l… |
CVE-2024-44400 | Critical | 9.8 | 2024-09-04 | A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_… |
CVE-2024-44383 | Medium | 6.8 | 2024-09-04 | WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp_info_htm. |
CVE-2024-8413 | Medium | 5.4 | 2024-09-04 | Cross Site Scripting (XSS) vulnerability through the action parameter in index.php. Affected product codebase https://github.com/Bioshox/Raspcontrol and fork… |
CVE-2024-8289 | Critical | 9.8 | 2024-09-04 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and accou… |
CVE-2024-7870 | Medium | 6.5 | 2024-09-04 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in al… |
CVE-2024-45507 | Critical | 9.8 | 2024-09-04 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45195 | High | 7.5 | 2024-09-04 | Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to versi… |
CVE-2024-8318 | Medium | 6.4 | 2024-09-04 | The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all versions up to, and… |
CVE-2024-8123 | Medium | 5.4 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3… |
CVE-2024-8121 | Medium | 5.4 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability chec… |
CVE-2024-8119 | Medium | 6.1 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up… |
CVE-2024-8117 | Medium | 6.1 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘selected_option’ parameter in al… |
CVE-2024-8106 | Medium | 6.5 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0… |
CVE-2024-8104 | High | 8.8 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the… |
CVE-2024-8102 | High | 8.8 | 2024-09-04 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation… |
CVE-2024-8325 | Medium | 6.4 | 2024-09-04 | The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Import… |
CVE-2024-7786 | Medium | 5.3 | 2024-09-04 | The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. |
CVE-2024-6926 | Critical | 9.8 | 2024-09-04 | The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action availabl… |
CVE-2024-6889 | Medium | 4.8 | 2024-09-04 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6888 | Medium | 4.8 | 2024-09-04 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6722 | Medium | 4.8 | 2024-09-04 | The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could… |
CVE-2024-6020 | Medium | 6.1 | 2024-09-04 | The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them… |
CVE-2024-34661 | Medium | 4.3 | 2024-09-04 | Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction… |
CVE-2024-34660 | High | 7.3 | 2024-09-04 | Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34659 | High | 7.5 | 2024-09-04 | Exposure of sensitive information in GroupSharing prior to version 13.6.13.3 allows remote attackers can force the victim to join the group. |
CVE-2024-34658 | Medium | 4.0 | 2024-09-04 | Out-of-bounds read in Samsung Notes allows local attackers to bypass ASLR. |
CVE-2024-34657 | High | 8.6 | 2024-09-04 | Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary code. |
CVE-2024-34656 | High | 7.3 | 2024-09-04 | Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. |
CVE-2024-34655 | Medium | 6.2 | 2024-09-04 | Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to access privileged API related to Univer… |
CVE-2024-34654 | Medium | 6.2 | 2024-09-04 | Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege. |