2024 CVEs (page 183)
Page 183 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8388 | Medium | 5.3 | 2024-09-03 | Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after t… |
CVE-2024-8387 | Critical | 9.8 | 2024-09-03 | Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-8386 | Medium | 6.1 | 2024-09-03 | If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack… |
CVE-2024-8385 | Critical | 9.8 | 2024-09-03 | A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability af… |
CVE-2024-8384 | Critical | 9.8 | 2024-09-03 | The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could ha… |
CVE-2024-8383 | High | 7.5 | 2024-09-03 | Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did n… |
CVE-2024-8382 | High | 8.8 | 2024-09-03 | Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to u… |
CVE-2024-8381 | Critical | 9.8 | 2024-09-03 | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerabili… |
CVE-2024-6232 | High | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing… |
CVE-2024-44921 | Critical | 9.8 | 2024-09-03 | SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del. |
CVE-2024-44920 | Medium | 6.1 | 2024-09-03 | A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2024-6473 | High | 7.8 | 2024-09-03 | Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. |
CVE-2024-45588 | High | 8.1 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the app… |
CVE-2024-8374 | High | 7.8 | 2024-09-03 | UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerabi… |
CVE-2024-45587 | High | 8.8 | 2024-09-03 | This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulner… |
CVE-2024-45586 | High | 8.8 | 2024-09-03 | This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (versio… |
CVE-2024-3655 | High | 7.8 | 2024-09-03 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-38811 | High | 8.8 | 2024-09-03 | VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard… |
CVE-2024-37136 | Medium | 6.8 | 2024-09-03 | Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privil… |
CVE-2024-7261 | Critical | 9.8 | 2024-09-03 | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC5… |
CVE-2024-42061 | Medium | 6.1 | 2024-09-03 | A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, US… |
CVE-2024-7203 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from… |
CVE-2024-6343 | Medium | 4.9 | 2024-09-03 | A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50… |
CVE-2024-5412 | High | 7.5 | 2024-09-03 | A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenticated attacker to… |
CVE-2024-42060 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4… |
CVE-2024-42059 | High | 7.2 | 2024-09-03 | A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5… |
CVE-2024-42058 | High | 7.5 | 2024-09-03 | A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V… |
CVE-2024-42057 | High | 8.1 | 2024-09-03 | A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions fr… |
CVE-2024-8380 | Medium | 6.3 | 2024-09-03 | A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2024-45623 | Critical | 9.8 | 2024-09-02 | D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handle… |
CVE-2024-1621 | High | 7.5 | 2024-09-02 | The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on t… |
CVE-2024-45622 | Critical | 9.8 | 2024-09-02 | ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. |
CVE-2024-45621 | Medium | 5.4 | 2024-09-02 | The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upo… |
CVE-2024-6921 | High | 7.5 | 2024-09-02 | Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data. This issue… |
CVE-2024-6920 | Medium | 6.1 | 2024-09-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Stor… |
CVE-2024-6919 | Critical | 9.8 | 2024-09-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blin… |
CVE-2024-45388 | High | 7.5 | 2024-09-02 | Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows us… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-45312 | Medium | 5.3 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vu… |
CVE-2024-45311 | High | 7.5 | 2024-09-02 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `… |
CVE-2024-45308 | Medium | 6.5 | 2024-09-02 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes w… |
CVE-2024-45306 | Medium | 4.5 | 2024-09-02 | Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cur… |
CVE-2024-45305 | Low | 2.5 | 2024-09-02 | gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file th… |
CVE-2024-44947 | Medium | 5.5 | 2024-09-02 | In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), un… |
CVE-2024-43801 | Medium | 4.6 | 2024-09-02 | Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admi… |
CVE-2024-43797 | Medium | 6.3 | 2024-09-02 | audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission… |
CVE-2024-43792 | Medium | 6.3 | 2024-09-02 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability… |
CVE-2024-42471 | High | 7.3 | 2024-09-02 | actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrar… |
CVE-2024-28100 | High | 8.9 | 2024-09-02 | eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a vis… |
CVE-2024-8004 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-7939 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script co… |
CVE-2024-7938 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows… |
CVE-2024-7932 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary scri… |
CVE-2024-5148 | High | 7.5 | 2024-09-02 | A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus metho… |
CVE-2024-38858 | Medium | 6.1 | 2024-09-02 | Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view. |
CVE-2024-38402 | High | 7.8 | 2024-09-02 | Memory corruption while processing IOCTL call for getting group info. |
CVE-2024-38401 | High | 7.8 | 2024-09-02 | Memory corruption while processing concurrent IOCTL calls. |
CVE-2024-33060 | High | 8.4 | 2024-09-02 | Memory corruption when two threads try to map and unmap a single node simultaneously. |
CVE-2024-33057 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
CVE-2024-33054 | High | 7.8 | 2024-09-02 | Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine. |
CVE-2024-33052 | High | 7.8 | 2024-09-02 | Memory corruption when user provides data for FM HCI command control operations. |
CVE-2024-33051 | High | 7.5 | 2024-09-02 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. |
CVE-2024-33050 | High | 7.5 | 2024-09-02 | Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
CVE-2024-33048 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. |
CVE-2024-33047 | High | 8.4 | 2024-09-02 | Memory corruption when the captureRead QDCM command is invoked from user-space. |
CVE-2024-33045 | High | 8.4 | 2024-09-02 | Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
CVE-2024-33043 | Medium | 5.5 | 2024-09-02 | Transient DOS while handling PS event when Program Service name length offset value is set to 255. |
CVE-2024-33042 | High | 7.8 | 2024-09-02 | Memory corruption when Alternative Frequency offset value is set to 255. |
CVE-2024-33038 | High | 7.8 | 2024-09-02 | Memory corruption while passing untrusted/corrupted pointers from DSP to EVA. |
CVE-2024-33035 | High | 8.4 | 2024-09-02 | Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients. |
CVE-2024-33016 | Medium | 6.8 | 2024-09-02 | memory corruption when an invalid firehose patch command is invoked. |
CVE-2024-23365 | High | 8.4 | 2024-09-02 | Memory corruption while releasing shared resources in MinkSocket listener thread. |
CVE-2024-23364 | High | 7.5 | 2024-09-02 | Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is recei… |
CVE-2024-23362 | High | 7.1 | 2024-09-02 | Cryptographic issue while parsing RSA keys in COBR format. |
CVE-2024-23359 | High | 8.2 | 2024-09-02 | Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network. |
CVE-2024-23358 | High | 7.5 | 2024-09-02 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem. |
CVE-2024-7692 | Medium | 6.1 | 2024-09-02 | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-7691 | Medium | 6.1 | 2024-09-02 | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Sc… |
CVE-2024-7690 | Medium | 4.3 | 2024-09-02 | The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-7354 | Medium | 6.1 | 2024-09-02 | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting w… |
CVE-2024-8365 | Medium | 6.2 | 2024-09-02 | Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifi… |
CVE-2024-7871 | High | 8.8 | 2024-09-02 | SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL co… |
CVE-2024-45528 | Medium | 5.4 | 2024-09-02 | CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS. |
CVE-2024-45527 | Medium | 6.1 | 2024-09-02 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also… |
CVE-2024-43776 | High | 8.8 | 2024-09-02 | SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands v… |
CVE-2024-43775 | High | 8.8 | 2024-09-02 | SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL… |
CVE-2024-43774 | High | 8.8 | 2024-09-02 | SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute… |
CVE-2024-43773 | Critical | 9.8 | 2024-09-02 | SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL… |
CVE-2024-43772 | Critical | 9.8 | 2024-09-02 | SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary S… |
CVE-2024-41160 | High | 8.8 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2024-41157 | High | 8.8 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2024-39816 | High | 8.4 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-39775 | Medium | 6.5 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read. |
CVE-2024-39612 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-38386 | High | 8.4 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-38382 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-28044 | Low | 3.3 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow. |
CVE-2024-20089 | High | 7.5 | 2024-09-02 | In wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2024-20088 | Medium | 4.4 | 2024-09-02 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2024-20087 | Medium | 6.7 | 2024-09-02 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |