2024 CVEs (page 196)
Page 196 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42264 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the numb… |
CVE-2024-42263 | Medium | 5.5 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace me… |
CVE-2024-42262 | Medium | 5.5 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the performance extension If fetching of userspace… |
CVE-2024-42261 | Medium | 5.5 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the timestamp extension If userspace p… |
CVE-2024-42260 | Medium | 5.5 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the performance extension If userspace… |
CVE-2024-6459 | Critical | 9.8 | 2024-08-17 | The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible… |
CVE-2024-6500 | Critical | 10.0 | 2024-08-17 | The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability che… |
CVE-2024-7886 | High | 7.8 | 2024-08-16 | A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-43395 | High | 8.2 | 2024-08-16 | CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as S… |
CVE-2024-43472 | Medium | 5.8 | 2024-08-16 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-43042 | Critical | 9.8 | 2024-08-16 | Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. |
CVE-2024-43011 | Medium | 4.9 | 2024-08-16 | An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization… |
CVE-2024-43009 | Medium | 4.7 | 2024-08-16 | A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value… |
CVE-2024-43006 | Medium | 5.4 | 2024-08-16 | A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sendin… |
CVE-2024-43005 | Medium | 4.7 | 2024-08-16 | A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the conte… |
CVE-2024-42850 | Critical | 9.8 | 2024-08-16 | An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. |
CVE-2024-42849 | Medium | 6.5 | 2024-08-16 | An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. |
CVE-2024-7646 | High | 8.8 | 2024-08-16 | A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group… |
CVE-2024-42758 | Medium | 5.4 | 2024-08-16 | A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine)… |
CVE-2024-42639 | Critical | 9.8 | 2024-08-16 | H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-42638 | Critical | 9.8 | 2024-08-16 | H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-42637 | Critical | 9.8 | 2024-08-16 | H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-25837 | Medium | 5.4 | 2024-08-16 | A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-42995 | High | 8.3 | 2024-08-16 | VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable… |
CVE-2024-42994 | High | 7.2 | 2024-08-16 | VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of t… |
CVE-2024-42634 | Critical | 9.8 | 2024-08-16 | A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with r… |
CVE-2024-6098 | Medium | 5.3 | 2024-08-16 | When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not confi… |
CVE-2024-6004 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connect… |
CVE-2024-5210 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer serv… |
CVE-2024-5209 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabi… |
CVE-2024-4782 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer'… |
CVE-2024-4781 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer commun… |
CVE-2024-4763 | High | 7.8 | 2024-08-16 | An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a lo… |
CVE-2024-43810 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin |
CVE-2024-43809 | Low | 3.5 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page |
CVE-2024-43808 | Low | 3.7 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin |
CVE-2024-43807 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page |
CVE-2024-43381 | Medium | 5.0 | 2024-08-16 | reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. T… |
CVE-2024-42486 | Medium | 5.4 | 2024-08-16 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x bran… |
CVE-2024-2175 | High | 7.8 | 2024-08-16 | An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow… |
CVE-2024-7145 | High | 8.8 | 2024-08-16 | The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This… |
CVE-2024-7144 | Medium | 6.4 | 2024-08-16 | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including… |
CVE-2024-42466 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-42465 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-42464 | Medium | 6.5 | 2024-08-16 | Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resou… |
CVE-2024-42463 | Medium | 6.5 | 2024-08-16 | Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resou… |
CVE-2024-42462 | Critical | 9.8 | 2024-08-16 | Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through… |
CVE-2024-7147 | Medium | 6.4 | 2024-08-16 | The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and in… |
CVE-2024-7146 | High | 8.8 | 2024-08-16 | The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcher_preset' para… |
CVE-2024-7136 | Medium | 6.4 | 2024-08-16 | The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insuf… |
CVE-2024-25008 | Medium | 6.8 | 2024-08-16 | Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code executi… |
CVE-2024-7501 | Medium | 4.2 | 2024-08-16 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2024-6460 | Critical | 9.8 | 2024-08-16 | The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attacke… |
CVE-2024-7301 | High | 7.2 | 2024-08-16 | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 d… |
CVE-2024-7422 | Medium | 4.3 | 2024-08-16 | The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or inco… |
CVE-2024-7630 | Medium | 5.3 | 2024-08-16 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Pre… |
CVE-2024-7853 | Medium | 6.3 | 2024-08-16 | A vulnerability was found in SourceCodester Yoga Class Registration System up to 1.0. It has been classified as critical. Affected is an unknown function of th… |
CVE-2024-7852 | Low | 3.5 | 2024-08-16 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as problematic. This issue affects some unknown processing of the… |
CVE-2024-7851 | Medium | 6.3 | 2024-08-16 | A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-7849 | High | 8.8 | 2024-08-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320L… |
CVE-2024-7845 | Medium | 6.3 | 2024-08-16 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-43378 | High | 7.8 | 2024-08-16 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical inst… |
CVE-2024-43374 | Medium | 4.5 | 2024-08-16 | The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers… |
CVE-2024-43370 | High | 7.2 | 2024-08-16 | gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition files are corrupted… |
CVE-2024-43369 | High | 7.2 | 2024-08-16 | Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10… |
CVE-2024-7844 | Low | 3.5 | 2024-08-15 | A vulnerability has been found in SourceCodester Online Graduate Tracer System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-7843 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2024-7842 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown proce… |
CVE-2024-7841 | Medium | 6.3 | 2024-08-15 | A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System 1.0. This vulnerability affects unknown code of the file /… |
CVE-2024-34743 | High | 7.8 | 2024-08-15 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalati… |
CVE-2024-34742 | Medium | 5.5 | 2024-08-15 | In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in the code. This could l… |
CVE-2024-34741 | High | 7.8 | 2024-08-15 | In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock scre… |
CVE-2024-34740 | High | 7.8 | 2024-08-15 | In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could l… |
CVE-2024-34739 | High | 7.8 | 2024-08-15 | In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lea… |
CVE-2024-34738 | High | 7.8 | 2024-08-15 | In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in… |
CVE-2024-34737 | High | 7.8 | 2024-08-15 | In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a log… |
CVE-2024-34736 | High | 7.8 | 2024-08-15 | In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled. This could lead to local escalation… |
CVE-2024-34734 | High | 7.8 | 2024-08-15 | In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure… |
CVE-2024-34731 | High | 7.0 | 2024-08-15 | In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of p… |
CVE-2024-34727 | High | 7.5 | 2024-08-15 | In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information dis… |
CVE-2024-31333 | High | 7.8 | 2024-08-15 | In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege i… |
CVE-2024-7868 | High | 8.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file… |
CVE-2024-7839 | High | 7.3 | 2024-08-15 | A vulnerability classified as critical has been found in itsourcecode Billing System 1.0. This affects an unknown part of the file addbill.php. The manipulatio… |
CVE-2024-6456 | | 2024-08-15 | AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST… | |
CVE-2024-43367 | High | 7.5 | 2024-08-15 | Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when han… |
CVE-2024-43366 | High | 7.5 | 2024-08-15 | zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a… |
CVE-2024-42488 | Medium | 6.8 | 2024-08-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium… |
CVE-2024-42487 | Medium | 4.0 | 2024-08-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16… |
CVE-2024-7867 | Medium | 6.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero. |
CVE-2024-7866 | Medium | 5.5 | 2024-08-15 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. |
CVE-2024-7838 | High | 7.3 | 2024-08-15 | A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-43357 | High | 8.6 | 2024-08-15 | ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, intro… |
CVE-2024-42757 | Critical | 9.8 | 2024-08-15 | Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page. |
CVE-2024-42476 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site re… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-42472 | Critical | 10.0 | 2024-08-15 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persis… |
CVE-2024-27731 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the f… |
CVE-2024-27730 | Critical | 9.8 | 2024-08-15 | Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid param… |
CVE-2024-27729 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar e… |
CVE-2024-27728 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug fe… |