2024 CVEs (page 205)
Page 205 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7143 | High | 8.3 | 2024-08-07 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAdd… |
CVE-2024-7061 | Medium | 5.5 | 2024-08-07 | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To re… |
CVE-2024-41250 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41245 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote una… |
CVE-2024-41244 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-41243 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauth… |
CVE-2024-20479 | Medium | 4.8 | 2024-08-07 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the… |
CVE-2024-20454 | Critical | 9.8 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20451 | High | 7.5 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20450 | Critical | 9.8 | 2024-08-07 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones… |
CVE-2024-20443 | Medium | 5.4 | 2024-08-07 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the… |
CVE-2024-7583 | High | 8.8 | 2024-08-07 | A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the fil… |
CVE-2024-7582 | High | 8.8 | 2024-08-07 | A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /go… |
CVE-2024-42250 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll… |
CVE-2024-42249 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in sp… |
CVE-2024-42248 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if th… |
CVE-2024-42247 | High | 7.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the… |
CVE-2024-42246 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using… |
CVE-2024-42245 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts co… |
CVE-2024-42244 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use ge… |
CVE-2024-42243 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series "mm/filemap: Limit… |
CVE-2024-42242 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: … |
CVE-2024-42241 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-… |
CVE-2024-42240 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enable… |
CVE-2024-42239 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb … |
CVE-2024-42238 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp… |
CVE-2024-42237 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length… |
CVE-2024-42236 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided str… |
CVE-2024-42235 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() u… |
CVE-2024-42234 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been se… |
CVE-2024-42233 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in filemap_fa… |
CVE-2024-42232 | Critical | 9.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is… |
CVE-2024-41432 | Medium | 5.3 | 2024-08-07 | An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbi… |
CVE-2024-41309 | High | 7.8 | 2024-08-07 | An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privi… |
CVE-2024-41308 | High | 7.8 | 2024-08-07 | An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on… |
CVE-2024-41252 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kaship… |
CVE-2024-41251 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kaship… |
CVE-2024-41249 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unau… |
CVE-2024-41248 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System… |
CVE-2024-41247 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2… |
CVE-2024-41246 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote u… |
CVE-2024-34480 | Critical | 9.8 | 2024-08-07 | SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection. |
CVE-2024-34479 | Critical | 9.8 | 2024-08-07 | SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection. |
CVE-2024-7581 | High | 8.8 | 2024-08-07 | A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. T… |
CVE-2024-7580 | Medium | 6.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-42005 | High | 7.3 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to… |
CVE-2024-41991 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are… |
CVE-2024-41990 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-… |
CVE-2024-41989 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when giv… |
CVE-2024-7579 | Medium | 6.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function pope… |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-43045 | Medium | 6.3 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to… |
CVE-2024-43044 | High | 8.8 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLo… |
CVE-2024-7578 | High | 7.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/… |
CVE-2024-7355 | Medium | 4.9 | 2024-08-07 | The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions… |
CVE-2024-7353 | Medium | 5.4 | 2024-08-07 | The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's accept_stripe_payment_ng shortcode in all version… |
CVE-2024-7267 | Medium | 6.5 | 2024-08-07 | Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve… |
CVE-2024-7266 | Medium | 4.3 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users i… |
CVE-2024-7265 | High | 8.8 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the passw… |
CVE-2024-6522 | High | 8.5 | 2024-08-07 | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-5290 | High | 8.8 | 2024-08-07 | An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate p… |
CVE-2024-42222 | Medium | 4.3 | 2024-08-07 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user acco… |
CVE-2024-42062 | High | 7.2 | 2024-08-07 | CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised AP… |
CVE-2024-6494 | Medium | 6.1 | 2024-08-07 | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to e… |
CVE-2024-3973 | Medium | 4.8 | 2024-08-07 | The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-37403 | Medium | 5.5 | 2024-08-07 | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting i… |
CVE-2024-36132 | High | 7.5 | 2024-08-07 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. |
CVE-2024-36131 | High | 8.8 | 2024-08-07 | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on t… |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-34636 | Medium | 4.0 | 2024-08-07 | Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information. |
CVE-2024-34635 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34634 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34633 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34632 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34631 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34630 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34629 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34628 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34627 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34626 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34625 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34624 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34623 | High | 7.8 | 2024-08-07 | Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code… |
CVE-2024-34622 | High | 7.8 | 2024-08-07 | Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsun… |
CVE-2024-34621 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34620 | High | 8.4 | 2024-08-07 | Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service. |
CVE-2024-34619 | High | 7.5 | 2024-08-07 | Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interactio… |
CVE-2024-34618 | Medium | 4.0 | 2024-08-07 | Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information. |
CVE-2024-34617 | Medium | 4.0 | 2024-08-07 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application. |
CVE-2024-34616 | Medium | 5.1 | 2024-08-07 | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34615 | Medium | 5.1 | 2024-08-07 | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34614 | High | 7.3 | 2024-08-07 | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-34613 | Medium | 4.0 | 2024-08-07 | Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
CVE-2024-34612 | High | 7.3 | 2024-08-07 | Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-34611 | Medium | 5.1 | 2024-08-07 | Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34610 | Medium | 5.1 | 2024-08-07 | Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data. |
CVE-2024-34609 | Medium | 6.2 | 2024-08-07 | Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgro… |
CVE-2024-34608 | Medium | 6.2 | 2024-08-07 | Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the ba… |