2024 CVEs (page 204)
Page 204 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0102 | Low | 3.3 | 2024-08-08 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiving a user into re… |
CVE-2024-0101 | High | 7.5 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to… |
CVE-2024-7480 | Medium | 4.2 | 2024-08-08 | An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privi… |
CVE-2024-7477 | Medium | 6.5 | 2024-08-08 | A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries again… |
CVE-2024-41238 | Medium | 5.3 | 2024-08-08 | A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-7490 | Critical | 9.8 | 2024-08-08 | Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer… |
CVE-2024-42357 | High | 7.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users… |
CVE-2024-42356 | High | 8.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to a… |
CVE-2024-42355 | High | 8.3 | 2024-08-08 | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to ver… |
CVE-2024-42354 | Medium | 5.3 | 2024-08-08 | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiA… |
CVE-2024-41942 | High | 7.2 | 2024-08-08 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin… |
CVE-2024-7348 | High | 8.8 | 2024-08-08 | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_d… |
CVE-2024-3659 | High | 7.2 | 2024-08-08 | Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the en… |
CVE-2024-7610 | Medium | 4.3 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-7554 | Medium | 4.9 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versio… |
CVE-2024-5423 | Medium | 6.5 | 2024-08-08 | Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 pr… |
CVE-2024-4207 | Medium | 4.4 | 2024-08-08 | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and start… |
CVE-2024-3958 | Medium | 5.3 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allo… |
CVE-2024-3114 | Medium | 4.3 | 2024-08-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the pr… |
CVE-2024-3035 | Medium | 6.8 | 2024-08-08 | A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 all… |
CVE-2024-2800 | Medium | 6.5 | 2024-08-08 | ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and… |
CVE-2024-6329 | Medium | 5.7 | 2024-08-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 p… |
CVE-2024-4784 | Medium | 4.2 | 2024-08-08 | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the pas… |
CVE-2024-4210 | Medium | 6.5 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-42038 | High | 8.8 | 2024-08-08 | Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, i… |
CVE-2024-42037 | Critical | 9.3 | 2024-08-08 | Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42036 | Low | 2.5 | 2024-08-08 | Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42035 | High | 8.4 | 2024-08-08 | Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality. |
CVE-2024-42034 | Medium | 6.6 | 2024-08-08 | LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42033 | Medium | 6.9 | 2024-08-08 | Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-42257 | High | 7.8 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super… |
CVE-2024-42256 | High | 7.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing re… |
CVE-2024-42255 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth aft… |
CVE-2024-42254 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_E… |
CVE-2024-42253 | High | 7.8 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when s… |
CVE-2024-42252 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn't… |
CVE-2024-42251 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ref: remove folio_try_get_rcu() The below bug was reported on a non-SMP kernel: … |
CVE-2024-42032 | Medium | 4.4 | 2024-08-08 | Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42031 | High | 7.5 | 2024-08-08 | Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42030 | Medium | 6.2 | 2024-08-08 | Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service conf… |
CVE-2024-22069 | High | 7.1 | 2024-08-08 | There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and cha… |
CVE-2024-7548 | High | 8.8 | 2024-08-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and inclu… |
CVE-2024-7150 | High | 8.8 | 2024-08-08 | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and… |
CVE-2024-6884 | Medium | 5.4 | 2024-08-08 | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back i… |
CVE-2024-6824 | Medium | 4.3 | 2024-08-08 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'che… |
CVE-2024-6481 | Medium | 4.8 | 2024-08-08 | The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-5226 | Medium | 6.4 | 2024-08-08 | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and… |
CVE-2024-6987 | Medium | 4.3 | 2024-08-08 | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin'… |
CVE-2024-6869 | Medium | 5.4 | 2024-08-08 | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several fun… |
CVE-2024-5668 | Medium | 6.4 | 2024-08-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in al… |
CVE-2024-6552 | Medium | 5.3 | 2024-08-08 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2… |
CVE-2024-6254 | Medium | 4.3 | 2024-08-08 | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing o… |
CVE-2024-7492 | High | 8.8 | 2024-08-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or… |
CVE-2024-7350 | Critical | 9.8 | 2024-08-08 | The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1… |
CVE-2024-7561 | High | 8.8 | 2024-08-08 | The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from… |
CVE-2024-7560 | High | 7.2 | 2024-08-08 | The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input fro… |
CVE-2024-7486 | High | 8.8 | 2024-08-08 | The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input t… |
CVE-2024-38202 | High | 7.3 | 2024-08-08 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileg… |
CVE-2024-21302 | Medium | 6.7 | 2024-08-08 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-… |
CVE-2024-6893 | High | 7.5 | 2024-08-08 | The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read… |
CVE-2024-6892 | Medium | 6.1 | 2024-08-08 | Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. |
CVE-2024-6891 | High | 8.8 | 2024-08-08 | Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-6707 | High | 8.8 | 2024-08-07 | Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. |
CVE-2024-6706 | Medium | 6.1 | 2024-08-07 | Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. |
CVE-2024-41912 | Critical | 9.8 | 2024-08-07 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access con… |
CVE-2024-41239 | Medium | 4.8 | 2024-08-07 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote… |
CVE-2024-41237 | Critical | 9.8 | 2024-08-07 | A SQL injection vulnerability in /smsa/teacher_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-41242 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows… |
CVE-2024-41241 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allow… |
CVE-2024-41240 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management System v3.2.0, which all… |
CVE-2024-7585 | High | 8.8 | 2024-08-07 | A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the… |
CVE-2024-7584 | High | 8.8 | 2024-08-07 | A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apP… |
CVE-2024-7143 | High | 8.3 | 2024-08-07 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAdd… |
CVE-2024-7061 | Medium | 5.5 | 2024-08-07 | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To re… |
CVE-2024-41250 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41245 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41244 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41243 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-20479 | Medium | 4.8 | 2024-08-07 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the… |
CVE-2024-20454 | Critical | 9.8 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20451 | High | 7.5 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20450 | Critical | 9.8 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20443 | Medium | 5.4 | 2024-08-07 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the… |
CVE-2024-7583 | High | 8.8 | 2024-08-07 | A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the fil… |
CVE-2024-7582 | High | 8.8 | 2024-08-07 | A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /go… |
CVE-2024-42250 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll… |
CVE-2024-42249 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in sp… |
CVE-2024-42248 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if th… |
CVE-2024-42247 | High | 7.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the… |
CVE-2024-42246 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using… |
CVE-2024-42245 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts co… |
CVE-2024-42244 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use ge… |
CVE-2024-42243 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series "mm/filemap: Limit… |
CVE-2024-42242 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: … |
CVE-2024-42241 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-… |
CVE-2024-42240 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enable… |
CVE-2024-42239 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb … |
CVE-2024-42238 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp… |
CVE-2024-42237 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length… |