2024 CVEs (page 191)
Page 191 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7978 | Medium | 4.3 | 2024-08-21 | Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2024-7977 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a mal… |
CVE-2024-7976 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2024-7975 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2024-7974 | High | 8.8 | 2024-08-21 | Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted C… |
CVE-2024-7973 | High | 8.8 | 2024-08-21 | Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file… |
CVE-2024-7972 | High | 8.8 | 2024-08-21 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a c… |
CVE-2024-7971 | Critical | 9.6 | 2024-08-21 | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security s… |
CVE-2024-7969 | High | 8.8 | 2024-08-21 | Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-7968 | High | 8.8 | 2024-08-21 | Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions t… |
CVE-2024-7967 | High | 8.8 | 2024-08-21 | Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-7966 | High | 8.8 | 2024-08-21 | Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out o… |
CVE-2024-7965 | High | 8.8 | 2024-08-21 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-7964 | High | 8.8 | 2024-08-21 | Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2024-6386 | Critical | 9.9 | 2024-08-21 | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This… |
CVE-2024-20486 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2024-20466 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-20417 | Medium | 6.5 | 2024-08-21 | Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection a… |
CVE-2024-41572 | Medium | 6.1 | 2024-08-21 | Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in… |
CVE-2024-20488 | Medium | 6.1 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2024-42786 | High | 8.8 | 2024-08-21 | A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the… |
CVE-2024-42785 | High | 8.8 | 2024-08-21 | A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-42784 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL… |
CVE-2024-42783 | Critical | 9.8 | 2024-08-21 | Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via… |
CVE-2024-42782 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-42781 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL comm… |
CVE-2024-42780 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to… |
CVE-2024-42779 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to… |
CVE-2024-42778 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers… |
CVE-2024-42777 | Critical | 9.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to exe… |
CVE-2024-7448 | High | 8.0 | 2024-08-21 | Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-6141 | High | 7.8 | 2024-08-21 | Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installat… |
CVE-2024-5930 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2024-5929 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat… |
CVE-2024-5928 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2024-5762 | High | 8.1 | 2024-08-21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5725 | High | 8.8 | 2024-08-21 | Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2024-5723 | High | 8.8 | 2024-08-21 | Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-43022 | High | 7.5 | 2024-08-21 | An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal. |
CVE-2024-42550 | Medium | 5.4 | 2024-08-21 | A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to… |
CVE-2024-40453 | Critical | 9.8 | 2024-08-21 | squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName. |
CVE-2024-33657 | High | 7.8 | 2024-08-21 | This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMR… |
CVE-2024-33656 | High | 7.8 | 2024-08-21 | The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbi… |
CVE-2024-20375 | High | 8.6 | 2024-08-21 | A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Manag… |
CVE-2024-7795 | High | 8.8 | 2024-08-21 | Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows n… |
CVE-2024-7725 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7724 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7723 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7722 | Medium | 4.3 | 2024-08-21 | Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information o… |
CVE-2024-7604 | High | 7.8 | 2024-08-21 | Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication… |
CVE-2024-7603 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary… |
CVE-2024-7602 | Medium | 6.5 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-7601 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-7600 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files… |
CVE-2024-6814 | High | 8.8 | 2024-08-21 | NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2024-6813 | High | 8.8 | 2024-08-21 | NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2024-6812 | High | 7.8 | 2024-08-21 | IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-6811 | High | 7.8 | 2024-08-21 | IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-43411 | Low | 3.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly… |
CVE-2024-43410 | High | 7.5 | 2024-08-21 | Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet cons… |
CVE-2024-43027 | High | 8.0 | 2024-08-21 | DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a comma… |
CVE-2024-41937 | Medium | 6.1 | 2024-08-21 | Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when cl… |
CVE-2024-39344 | High | 8.1 | 2024-08-21 | An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the market… |
CVE-2024-21690 | High | 8.2 | 2024-08-21 | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4… |
CVE-2024-43407 | Medium | 6.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. Th… |
CVE-2024-43371 | Medium | 4.5 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resou… |
CVE-2024-41675 | Medium | 6.8 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming fr… |
CVE-2024-41674 | Medium | 5.3 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr… |
CVE-2024-8007 | High | 8.1 | 2024-08-21 | A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy… |
CVE-2024-7885 | High | 7.5 | 2024-08-21 | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs wh… |
CVE-2024-28000 | Critical | 9.8 | 2024-08-21 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <=… |
CVE-2024-37008 | High | 7.8 | 2024-08-21 | A maliciously crafted DWG file, when parsed in Revit, can force a stack-based buffer overflow. A malicious actor can leverage this vulnerability to execute arb… |
CVE-2024-5335 | Critical | 9.8 | 2024-08-21 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is v… |
CVE-2024-6339 | Medium | 6.1 | 2024-08-21 | The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to ins… |
CVE-2024-7998 | Low | 2.6 | 2024-08-21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. |
CVE-2024-7854 | Critical | 10.0 | 2024-08-21 | The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied… |
CVE-2024-7651 | Medium | 5.6 | 2024-08-21 | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ param… |
CVE-2024-7647 | Medium | 6.1 | 2024-08-21 | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to… |
CVE-2024-7629 | Medium | 6.4 | 2024-08-21 | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and incl… |
CVE-2024-7390 | Medium | 5.3 | 2024-08-21 | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrd… |
CVE-2024-7134 | High | 7.2 | 2024-08-21 | The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘form_data’ parameter in al… |
CVE-2024-7090 | Medium | 6.1 | 2024-08-21 | The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ parameter in all versio… |
CVE-2024-7032 | Medium | 6.5 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndCl… |
CVE-2024-7030 | Medium | 4.3 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several function… |
CVE-2024-7013 | High | 7.8 | 2024-08-21 | Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafte… |
CVE-2024-6883 | Medium | 4.3 | 2024-08-21 | The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to… |
CVE-2024-6767 | Medium | 5.5 | 2024-08-21 | The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sounding_title’ parameter in all versions up to, and including, 3.2 d… |
CVE-2024-6568 | Medium | 5.3 | 2024-08-21 | The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. Th… |
CVE-2024-6508 | High | 8.0 | 2024-08-21 | An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulner… |
CVE-2024-5880 | Medium | 4.3 | 2024-08-21 | The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricti… |
CVE-2024-42939 | Medium | 5.4 | 2024-08-21 | A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-38305 | High | 7.3 | 2024-08-21 | Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticate… |
CVE-2024-43882 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec vi… |
CVE-2024-43881 | High | 8.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packet… |
CVE-2024-43880 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs ca… |
CVE-2024-43879 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Currently N… |
CVE-2024-43878 | High | 8.1 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state… |
CVE-2024-43877 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0… |
CVE-2024-43876 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() Avoid large back… |
CVE-2024-43875 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpci_scan_bus() Smatch complains about inconsis… |