2024 CVEs (page 183)
Page 183 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8380 | Medium | 6.3 | 2024-09-03 | A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2024-45623 | Critical | 9.8 | 2024-09-02 | D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handle… |
CVE-2024-1621 | High | 7.5 | 2024-09-02 | The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on t… |
CVE-2024-45622 | Critical | 9.8 | 2024-09-02 | ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. |
CVE-2024-45621 | Medium | 5.4 | 2024-09-02 | The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upo… |
CVE-2024-6921 | High | 7.5 | 2024-09-02 | Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data. This issue… |
CVE-2024-6920 | Medium | 6.1 | 2024-09-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Stor… |
CVE-2024-6919 | Critical | 9.8 | 2024-09-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blin… |
CVE-2024-45388 | High | 7.5 | 2024-09-02 | Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows us… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-45312 | Medium | 5.3 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or 4.2.7 for the 4.x series) contain a vu… |
CVE-2024-45311 | High | 7.5 | 2024-09-02 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `… |
CVE-2024-45308 | Medium | 6.5 | 2024-09-02 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes w… |
CVE-2024-45306 | Medium | 4.5 | 2024-09-02 | Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cur… |
CVE-2024-45305 | Low | 2.5 | 2024-09-02 | gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file th… |
CVE-2024-44947 | Medium | 5.5 | 2024-09-02 | In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), un… |
CVE-2024-43801 | Medium | 4.6 | 2024-09-02 | Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admi… |
CVE-2024-43797 | Medium | 6.3 | 2024-09-02 | audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission… |
CVE-2024-43792 | Medium | 6.3 | 2024-09-02 | Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability… |
CVE-2024-42471 | High | 7.3 | 2024-09-02 | actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrar… |
CVE-2024-28100 | High | 8.9 | 2024-09-02 | eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a vis… |
CVE-2024-8004 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-7939 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script co… |
CVE-2024-7938 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows… |
CVE-2024-7932 | High | 8.7 | 2024-09-02 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary scri… |
CVE-2024-5148 | High | 7.5 | 2024-09-02 | A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus metho… |
CVE-2024-38858 | Medium | 6.1 | 2024-09-02 | Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view. |
CVE-2024-38402 | High | 7.8 | 2024-09-02 | Memory corruption while processing IOCTL call for getting group info. |
CVE-2024-38401 | High | 7.8 | 2024-09-02 | Memory corruption while processing concurrent IOCTL calls. |
CVE-2024-33060 | High | 8.4 | 2024-09-02 | Memory corruption when two threads try to map and unmap a single node simultaneously. |
CVE-2024-33057 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
CVE-2024-33054 | High | 7.8 | 2024-09-02 | Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine. |
CVE-2024-33052 | High | 7.8 | 2024-09-02 | Memory corruption when user provides data for FM HCI command control operations. |
CVE-2024-33051 | High | 7.5 | 2024-09-02 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. |
CVE-2024-33050 | High | 7.5 | 2024-09-02 | Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
CVE-2024-33048 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. |
CVE-2024-33047 | High | 8.4 | 2024-09-02 | Memory corruption when the captureRead QDCM command is invoked from user-space. |
CVE-2024-33045 | High | 8.4 | 2024-09-02 | Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
CVE-2024-33043 | Medium | 5.5 | 2024-09-02 | Transient DOS while handling PS event when Program Service name length offset value is set to 255. |
CVE-2024-33042 | High | 7.8 | 2024-09-02 | Memory corruption when Alternative Frequency offset value is set to 255. |
CVE-2024-33038 | High | 7.8 | 2024-09-02 | Memory corruption while passing untrusted/corrupted pointers from DSP to EVA. |
CVE-2024-33035 | High | 8.4 | 2024-09-02 | Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients. |
CVE-2024-33016 | Medium | 6.8 | 2024-09-02 | memory corruption when an invalid firehose patch command is invoked. |
CVE-2024-23365 | High | 8.4 | 2024-09-02 | Memory corruption while releasing shared resources in MinkSocket listener thread. |
CVE-2024-23364 | High | 7.5 | 2024-09-02 | Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is recei… |
CVE-2024-23362 | High | 7.1 | 2024-09-02 | Cryptographic issue while parsing RSA keys in COBR format. |
CVE-2024-23359 | High | 8.2 | 2024-09-02 | Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network. |
CVE-2024-23358 | High | 7.5 | 2024-09-02 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem. |
CVE-2024-7692 | Medium | 6.1 | 2024-09-02 | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-7691 | Medium | 6.1 | 2024-09-02 | The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Sc… |
CVE-2024-7690 | Medium | 4.3 | 2024-09-02 | The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2024-7354 | Medium | 6.1 | 2024-09-02 | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting w… |
CVE-2024-8365 | Medium | 6.2 | 2024-09-02 | Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifi… |
CVE-2024-7871 | High | 8.8 | 2024-09-02 | SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL co… |
CVE-2024-45528 | Medium | 5.4 | 2024-09-02 | CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS. |
CVE-2024-45527 | Medium | 6.1 | 2024-09-02 | REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also… |
CVE-2024-43776 | High | 8.8 | 2024-09-02 | SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands v… |
CVE-2024-43775 | High | 8.8 | 2024-09-02 | SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL… |
CVE-2024-43774 | High | 8.8 | 2024-09-02 | SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute… |
CVE-2024-43773 | Critical | 9.8 | 2024-09-02 | SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL… |
CVE-2024-43772 | Critical | 9.8 | 2024-09-02 | SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary S… |
CVE-2024-41160 | High | 8.8 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2024-41157 | High | 8.8 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2024-39816 | High | 8.4 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-39775 | Medium | 6.5 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read. |
CVE-2024-39612 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-38386 | High | 8.4 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-38382 | Medium | 5.5 | 2024-09-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-28044 | Low | 3.3 | 2024-09-02 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow. |
CVE-2024-20089 | High | 7.5 | 2024-09-02 | In wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2024-20088 | Medium | 4.4 | 2024-09-02 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2024-20087 | Medium | 6.7 | 2024-09-02 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-20086 | Medium | 6.7 | 2024-09-02 | In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-20085 | Medium | 4.4 | 2024-09-02 | In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privilege… |
CVE-2024-20084 | Medium | 4.4 | 2024-09-02 | In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privilege… |
CVE-2024-45522 | Critical | 9.8 | 2024-09-02 | Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgo… |
CVE-2024-45270 | Medium | 4.3 | 2024-09-02 | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged i… |
CVE-2024-45269 | Medium | 4.3 | 2024-09-02 | WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logg… |
CVE-2024-8370 | Low | 3.5 | 2024-09-01 | A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the… |
CVE-2024-45509 | Medium | 6.5 | 2024-09-01 | In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org ad… |
CVE-2024-45508 | Critical | 9.8 | 2024-09-01 | HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node. |
CVE-2024-5053 | Medium | 4.2 | 2024-09-01 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key… |
CVE-2024-8368 | High | 7.3 | 2024-09-01 | A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-8367 | Low | 3.5 | 2024-09-01 | A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as proble… |
CVE-2024-8366 | Medium | 4.3 | 2024-08-31 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /ind… |
CVE-2024-44946 | High | 7.8 | 2024-08-31 | In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release()… |
CVE-2024-8108 | Medium | 6.4 | 2024-08-31 | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, and including, 2.01… |
CVE-2024-7717 | High | 8.8 | 2024-08-31 | The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due… |
CVE-2024-0111 | Medium | 4.4 | 2024-08-31 | NVIDIA CUDA Toolkit contains a vulnerability in command 'cuobjdump' where a user may cause a crash or produce incorrect output by passing a malformed ELF file… |
CVE-2024-0110 | Medium | 4.4 | 2024-08-31 | NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause an out-of-bound write by passing in a malformed ELF file. A successf… |
CVE-2024-0109 | Low | 3.3 | 2024-08-31 | NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause a crash by passing in a malformed ELF file. A successful exploit of… |
CVE-2024-8276 | Medium | 6.4 | 2024-08-31 | The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the… |
CVE-2024-39579 | Medium | 6.7 | 2024-08-31 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contains an incorrect privilege assignment vulnerability. A local high privileged attacker could potenti… |
CVE-2024-39578 | Medium | 6.3 | 2024-08-31 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-44945 | High | 7.1 | 2024-08-31 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink: Initialise extack before use in ACKs Add missing extack initialisat… |
CVE-2024-5212 | Medium | 6.1 | 2024-08-31 | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including… |
CVE-2024-3886 | Medium | 6.1 | 2024-08-31 | The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including… |
CVE-2024-7435 | High | 8.8 | 2024-08-31 | The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This m… |
CVE-2024-39747 | High | 8.1 | 2024-08-31 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality. |
CVE-2024-8006 | Medium | 4.4 | 2024-08-31 | Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions t… |