2024 CVEs (page 192)
Page 192 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43874 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked Fix a null pointe… |
CVE-2024-43873 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allo… |
CVE-2024-43872 | High | 7.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler cu… |
CVE-2024-43871 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory l… |
CVE-2024-43870 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries a… |
CVE-2024-43869 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waite… |
CVE-2024-8023 | Medium | 6.3 | 2024-08-21 | A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list… |
CVE-2024-8022 | Low | 3.5 | 2024-08-21 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing o… |
CVE-2024-43868 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: riscv/purgatory: align riscv_kernel_entry When alignment handling is delegated to the ker… |
CVE-2024-43867 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo witho… |
CVE-2024-43866 | Medium | 4.7 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health in shutdown callback There is no point in recovery during d… |
CVE-2024-43865 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in load_fpu_state() With the recent rewrite of the fp… |
CVE-2024-43864 | Critical | 9.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates… |
CVE-2024-43863 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops… |
CVE-2024-43862 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex The carrier_lock spinloc… |
CVE-2024-22281 | High | 7.5 | 2024-08-20 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their… |
CVE-2024-43861 | Medium | 5.5 | 2024-08-20 | In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip pa… |
CVE-2024-43403 | High | 8.8 | 2024-08-20 | Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole calle… |
CVE-2024-43396 | Medium | 5.4 | 2024-08-20 | Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting i… |
CVE-2024-42363 | High | 8.8 | 2024-08-20 | Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the Role… |
CVE-2024-42362 | High | 8.8 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. Th… |
CVE-2024-42361 | High | 7.5 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to downl… |
CVE-2024-41658 | Medium | 6.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to… |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |
CVE-2024-7711 | Medium | 4.3 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any iss… |
CVE-2024-6800 | Critical | 9.8 | 2024-08-20 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizin… |
CVE-2024-6337 | Medium | 6.5 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: w… |
CVE-2024-41773 | Medium | 6.5 | 2024-08-20 | IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls. |
CVE-2024-41659 | High | 8.1 | 2024-08-20 | memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected wi… |
CVE-2024-31842 | High | 8.8 | 2024-08-20 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string f… |
CVE-2024-42619 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg… |
CVE-2024-38175 | Critical | 9.6 | 2024-08-20 | An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a netwo… |
CVE-2024-6322 | Medium | 5.4 | 2024-08-20 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associat… |
CVE-2024-42612 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add |
CVE-2024-35214 | | 2024-08-20 | A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentiall… | |
CVE-2024-43408 | Medium | 6.3 | 2024-08-20 | Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability… |
CVE-2024-42919 | Critical | 9.8 | 2024-08-20 | eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. |
CVE-2024-42598 | Medium | 6.7 | 2024-08-20 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited f… |
CVE-2024-40743 | Medium | 6.1 | 2024-08-20 | The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. |
CVE-2024-27187 | High | 7.5 | 2024-08-20 | Improper Access Controls allows backend users to overwrite their username when disallowed. |
CVE-2024-27186 | Medium | 6.1 | 2024-08-20 | The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. |
CVE-2024-27185 | Critical | 9.1 | 2024-08-20 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. |
CVE-2024-27184 | Medium | 6.1 | 2024-08-20 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-43406 | High | 8.8 | 2024-08-20 | LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit… |
CVE-2024-43404 | Critical | 9.8 | 2024-08-20 | MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execut… |
CVE-2024-43397 | Medium | 4.3 | 2024-08-20 | Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests t… |
CVE-2024-43377 | Medium | 5.4 | 2024-08-20 | Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. |
CVE-2024-43376 | Medium | 4.3 | 2024-08-20 | Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability… |
CVE-2024-42662 | High | 7.5 | 2024-08-20 | An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2024-42621 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php |
CVE-2024-42618 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma |
CVE-2024-42617 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32 |
CVE-2024-42616 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics |
CVE-2024-42613 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet |
CVE-2024-42611 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete |
CVE-2024-42610 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files |
CVE-2024-42609 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars |
CVE-2024-42607 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database |
CVE-2024-42606 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1 |
CVE-2024-42605 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1 |
CVE-2024-42604 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3 |
CVE-2024-42603 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall |
CVE-2024-42369 | Medium | 4.1 | 2024-08-20 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predeces… |
CVE-2024-39690 | High | 8.4 | 2024-08-20 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that ha… |
CVE-2024-35540 | Critical | 9.0 | 2024-08-20 | A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-30949 | Critical | 9.8 | 2024-08-20 | An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function. |
CVE-2024-8005 | High | 7.3 | 2024-08-20 | A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.g… |
CVE-2024-8003 | Low | 3.5 | 2024-08-20 | A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/a… |
CVE-2024-6379 | High | 7.7 | 2024-08-20 | A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker… |
CVE-2024-6378 | High | 8.7 | 2024-08-20 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-6377 | High | 8.1 | 2024-08-20 | An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-42608 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php. |
CVE-2024-42006 | High | 7.5 | 2024-08-20 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. |
CVE-2024-39094 | Medium | 5.4 | 2024-08-20 | Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. |
CVE-2024-34458 | High | 7.5 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. |
CVE-2024-33872 | Critical | 9.8 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges. |
CVE-2024-6918 | High | 7.5 | 2024-08-20 | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutech Manager when rece… |
CVE-2024-42586 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42585 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42584 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42583 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42582 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42581 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42580 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42579 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42578 | High | 8.0 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42577 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42576 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42575 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php. |
CVE-2024-42574 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php. |
CVE-2024-42573 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php. |
CVE-2024-42572 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php. |
CVE-2024-42571 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php. |
CVE-2024-42570 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php. |
CVE-2024-42569 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php. |
CVE-2024-42568 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php. |
CVE-2024-42567 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2. |
CVE-2024-42566 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php |
CVE-2024-42565 | Critical | 9.8 | 2024-08-20 | ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete. |