2024 CVEs (page 182)
Page 182 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34653 | Medium | 4.6 | 2024-09-04 | Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege. |
CVE-2024-34652 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage. |
CVE-2024-34651 | Medium | 6.2 | 2024-09-04 | Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files. |
CVE-2024-34650 | Medium | 4.0 | 2024-09-04 | Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel. |
CVE-2024-34649 | Low | 2.4 | 2024-09-04 | Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access an unlocked s… |
CVE-2024-34648 | Medium | 5.1 | 2024-09-04 | Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34647 | Medium | 4.0 | 2024-09-04 | Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to knox without… |
CVE-2024-34646 | Medium | 6.6 | 2024-09-04 | Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of service. |
CVE-2024-34645 | Medium | 6.1 | 2024-09-04 | Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications. |
CVE-2024-34644 | Medium | 4.4 | 2024-09-04 | Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interactio… |
CVE-2024-34643 | Medium | 4.4 | 2024-09-04 | Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User intera… |
CVE-2024-34642 | Medium | 4.6 | 2024-09-04 | Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information. |
CVE-2024-34641 | Medium | 5.1 | 2024-09-04 | Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration. |
CVE-2024-34640 | Low | 3.3 | 2024-09-04 | Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration. |
CVE-2024-34639 | Medium | 4.6 | 2024-09-04 | Improper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper validation. |
CVE-2024-34638 | Medium | 6.7 | 2024-09-04 | Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to delete non-preloaded applications. |
CVE-2024-34637 | Medium | 6.2 | 2024-09-04 | Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows l… |
CVE-2024-8298 | Medium | 6.2 | 2024-09-04 | Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-7950 | Critical | 9.8 | 2024-09-04 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settin… |
CVE-2024-45449 | Medium | 5.1 | 2024-09-04 | Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidenti… |
CVE-2024-45448 | Medium | 4.1 | 2024-09-04 | Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confi… |
CVE-2024-45447 | Medium | 4.4 | 2024-09-04 | Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45446 | Medium | 5.5 | 2024-09-04 | Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-45445 | Medium | 4.0 | 2024-09-04 | Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-45444 | Medium | 5.5 | 2024-09-04 | Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45443 | Medium | 6.1 | 2024-09-04 | Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2024-39921 | High | 7.5 | 2024-09-04 | Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IP… |
CVE-2024-45450 | Medium | 4.0 | 2024-09-04 | Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-45442 | Medium | 5.1 | 2024-09-04 | Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availabi… |
CVE-2024-45441 | Medium | 6.2 | 2024-09-04 | Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-42039 | Medium | 4.3 | 2024-09-04 | Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-41927 | Medium | 4.6 | 2024-09-04 | Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communicati… |
CVE-2024-41716 | High | 8.1 | 2024-09-04 | Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the pr… |
CVE-2024-8362 | High | 8.8 | 2024-09-03 | Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2024-7970 | High | 8.8 | 2024-09-03 | Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-45620 | Low | 3.9 | 2024-09-03 | A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a sp… |
CVE-2024-45619 | Medium | 4.3 | 2024-09-03 | A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would p… |
CVE-2024-45618 | Low | 3.9 | 2024-09-03 | A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially c… |
CVE-2024-45617 | Low | 3.9 | 2024-09-03 | A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would p… |
CVE-2024-45616 | Low | 3.9 | 2024-09-03 | A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would p… |
CVE-2024-45615 | Low | 3.9 | 2024-09-03 | A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be ini… |
CVE-2024-44809 | Critical | 9.8 | 2024-09-03 | A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. The issue arises from improper sanitization o… |
CVE-2024-45394 | High | 8.8 | 2024-09-03 | Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypt… |
CVE-2024-41433 | Critical | 9.8 | 2024-09-03 | PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList. This vulnerability allows attackers to caus… |
CVE-2024-8399 | Medium | 4.7 | 2024-09-03 | Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. |
CVE-2024-4629 | Medium | 6.5 | 2024-09-03 | A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating mu… |
CVE-2024-45678 | Medium | 4.2 | 2024-09-03 | Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that r… |
CVE-2024-45391 | High | 7.5 | 2024-09-03 | Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search to… |
CVE-2024-45390 | High | 7.3 | 2024-09-03 | @blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has acces… |
CVE-2024-45389 | Medium | 6.4 | 2024-09-03 | Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads… |
CVE-2024-45180 | Medium | 5.4 | 2024-09-03 | SquaredUp DS for SCOM 6.2.1.11104 allows XSS. |
CVE-2024-41434 | Medium | 4.3 | 2024-09-03 | PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS… |
CVE-2024-45310 | Low | 3.6 | 2024-09-03 | runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tr… |
CVE-2024-45307 | High | 8.8 | 2024-09-03 | SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretica… |
CVE-2024-43803 | Medium | 4.9 | 2024-09-03 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaDa… |
CVE-2024-43413 | Low | 3.5 | 2024-09-03 | Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xib… |
CVE-2024-41436 | High | 7.5 | 2024-09-03 | ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. |
CVE-2024-41435 | High | 7.5 | 2024-09-03 | YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter. |
CVE-2024-42904 | Medium | 6.1 | 2024-09-03 | A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the… |
CVE-2024-42903 | Medium | 6.5 | 2024-09-03 | A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password… |
CVE-2024-42902 | High | 8.8 | 2024-09-03 | An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the ln… |
CVE-2024-42901 | Medium | 4.8 | 2024-09-03 | A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file. |
CVE-2024-38456 | High | 7.8 | 2024-09-03 | HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in pruns… |
CVE-2024-43412 | Medium | 4.6 | 2024-09-03 | Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xib… |
CVE-2024-6119 | High | 7.5 | 2024-09-03 | Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address r… |
CVE-2024-42991 | High | 8.1 | 2024-09-03 | MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. |
CVE-2024-7654 | High | 8.3 | 2024-09-03 | An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthor… |
CVE-2024-7346 | High | 7.2 | 2024-09-03 | Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked co… |
CVE-2024-7345 | High | 8.3 | 2024-09-03 | Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supporte… |
CVE-2024-4259 | Critical | 9.8 | 2024-09-03 | Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by U… |
CVE-2024-34463 | Medium | 5.1 | 2024-09-03 | BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The packet data also lacks authentication an… |
CVE-2024-8389 | Critical | 9.8 | 2024-09-03 | Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-8388 | Medium | 5.3 | 2024-09-03 | Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after t… |
CVE-2024-8387 | Critical | 9.8 | 2024-09-03 | Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-8386 | Medium | 6.1 | 2024-09-03 | If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack… |
CVE-2024-8385 | Critical | 9.8 | 2024-09-03 | A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability af… |
CVE-2024-8384 | Critical | 9.8 | 2024-09-03 | The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could ha… |
CVE-2024-8383 | High | 7.5 | 2024-09-03 | Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did n… |
CVE-2024-8382 | High | 8.8 | 2024-09-03 | Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to u… |
CVE-2024-8381 | Critical | 9.8 | 2024-09-03 | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerabili… |
CVE-2024-6232 | High | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing… |
CVE-2024-44921 | Critical | 9.8 | 2024-09-03 | SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del. |
CVE-2024-44920 | Medium | 6.1 | 2024-09-03 | A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2024-6473 | High | 7.8 | 2024-09-03 | Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. |
CVE-2024-45588 | High | 8.1 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the app… |
CVE-2024-8374 | High | 7.8 | 2024-09-03 | UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerabi… |
CVE-2024-45587 | High | 8.8 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulner… |
CVE-2024-45586 | High | 8.8 | 2024-09-03 | This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (versio… |
CVE-2024-3655 | High | 7.8 | 2024-09-03 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-38811 | High | 8.8 | 2024-09-03 | VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard… |
CVE-2024-37136 | Medium | 6.8 | 2024-09-03 | Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privil… |
CVE-2024-7261 | Critical | 9.8 | 2024-09-03 | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC5… |
CVE-2024-42061 | Medium | 6.1 | 2024-09-03 | A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, US… |
CVE-2024-7203 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from… |
CVE-2024-6343 | Medium | 4.9 | 2024-09-03 | A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50… |
CVE-2024-5412 | High | 7.5 | 2024-09-03 | A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenticated attacker to… |
CVE-2024-42060 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4… |
CVE-2024-42059 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5… |
CVE-2024-42058 | High | 7.5 | 2024-09-03 | A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V… |
CVE-2024-42057 | High | 8.1 | 2024-09-03 | A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions fr… |