2024 CVEs (page 205)
Page 205 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42236 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided str… |
CVE-2024-42235 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() u… |
CVE-2024-42234 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been se… |
CVE-2024-42233 | High | 7.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in filemap_fa… |
CVE-2024-42232 | Critical | 9.8 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is… |
CVE-2024-41432 | Medium | 5.3 | 2024-08-07 | An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbi… |
CVE-2024-41309 | High | 7.8 | 2024-08-07 | An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privi… |
CVE-2024-41308 | High | 7.8 | 2024-08-07 | An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on… |
CVE-2024-41252 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_submit.php in Kaship… |
CVE-2024-41251 | Medium | 6.5 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kaship… |
CVE-2024-41249 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unau… |
CVE-2024-41248 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System… |
CVE-2024-41247 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Management System v3.2… |
CVE-2024-41246 | Medium | 5.3 | 2024-08-07 | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote u… |
CVE-2024-34480 | Critical | 9.8 | 2024-08-07 | SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection. |
CVE-2024-34479 | Critical | 9.8 | 2024-08-07 | SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection. |
CVE-2024-7581 | High | 8.8 | 2024-08-07 | A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. T… |
CVE-2024-7580 | Medium | 6.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-42005 | High | 7.3 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to… |
CVE-2024-41991 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are… |
CVE-2024-41990 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-… |
CVE-2024-41989 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when giv… |
CVE-2024-7579 | Medium | 6.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function pope… |
CVE-2024-43199 | High | 7.8 | 2024-08-07 | Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. |
CVE-2024-43045 | Medium | 6.3 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to… |
CVE-2024-43044 | High | 8.8 | 2024-08-07 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLo… |
CVE-2024-7578 | High | 7.3 | 2024-08-07 | A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/… |
CVE-2024-7355 | Medium | 4.9 | 2024-08-07 | The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions… |
CVE-2024-7353 | Medium | 5.4 | 2024-08-07 | The Accept Stripe Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's accept_stripe_payment_ng shortcode in all version… |
CVE-2024-7267 | Medium | 6.5 | 2024-08-07 | Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve… |
CVE-2024-7266 | Medium | 4.3 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users i… |
CVE-2024-7265 | High | 8.8 | 2024-08-07 | Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the passw… |
CVE-2024-6522 | High | 8.5 | 2024-08-07 | The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-5290 | High | 8.8 | 2024-08-07 | An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate p… |
CVE-2024-42222 | Medium | 4.3 | 2024-08-07 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user acco… |
CVE-2024-42062 | High | 7.2 | 2024-08-07 | CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised AP… |
CVE-2024-6494 | Medium | 6.1 | 2024-08-07 | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to e… |
CVE-2024-3973 | Medium | 4.8 | 2024-08-07 | The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-37403 | Medium | 5.5 | 2024-08-07 | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting i… |
CVE-2024-36132 | High | 7.5 | 2024-08-07 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. |
CVE-2024-36131 | High | 8.8 | 2024-08-07 | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on t… |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-34636 | Medium | 4.0 | 2024-08-07 | Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information. |
CVE-2024-34635 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34634 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34633 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34632 | Medium | 4.0 | 2024-08-07 | Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. |
CVE-2024-34631 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34630 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34629 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34628 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34627 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34626 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34625 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34624 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34623 | High | 7.8 | 2024-08-07 | Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code… |
CVE-2024-34622 | High | 7.8 | 2024-08-07 | Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitrary code with Samsun… |
CVE-2024-34621 | Medium | 5.5 | 2024-08-07 | Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. |
CVE-2024-34620 | High | 8.4 | 2024-08-07 | Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service. |
CVE-2024-34619 | High | 7.5 | 2024-08-07 | Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interactio… |
CVE-2024-34618 | Medium | 4.0 | 2024-08-07 | Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information. |
CVE-2024-34617 | Medium | 4.0 | 2024-08-07 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application. |
CVE-2024-34616 | Medium | 5.1 | 2024-08-07 | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data. |
CVE-2024-34615 | Medium | 5.1 | 2024-08-07 | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption. |
CVE-2024-34614 | High | 7.3 | 2024-08-07 | Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-34613 | Medium | 4.0 | 2024-08-07 | Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
CVE-2024-34612 | High | 7.3 | 2024-08-07 | Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-34611 | Medium | 5.1 | 2024-08-07 | Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-34610 | Medium | 5.1 | 2024-08-07 | Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data. |
CVE-2024-34609 | Medium | 6.2 | 2024-08-07 | Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgro… |
CVE-2024-34608 | Medium | 6.2 | 2024-08-07 | Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the ba… |
CVE-2024-34607 | Medium | 6.2 | 2024-08-07 | Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the back… |
CVE-2024-34606 | Medium | 6.2 | 2024-08-07 | Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backg… |
CVE-2024-34605 | Medium | 6.2 | 2024-08-07 | Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the bac… |
CVE-2024-34604 | Medium | 6.2 | 2024-08-07 | Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgrou… |
CVE-2024-38206 | High | 8.5 | 2024-08-06 | An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. |
CVE-2024-38166 | High | 8.2 | 2024-08-06 | An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricki… |
CVE-2024-7550 | High | 8.8 | 2024-08-06 | Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-7536 | High | 8.8 | 2024-08-06 | Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-7535 | High | 8.8 | 2024-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-7534 | High | 8.8 | 2024-08-06 | Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-7533 | High | 8.8 | 2024-08-06 | Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2024-7532 | High | 8.8 | 2024-08-06 | Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2024-42219 | High | 7.8 | 2024-08-06 | 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient. |
CVE-2024-42218 | Medium | 4.7 | 2024-08-06 | 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms. |
CVE-2024-41270 | Critical | 9.1 | 2024-08-06 | An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version. |
CVE-2024-42400 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42399 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42398 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42397 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42396 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-42393 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-28740 | Critical | 9.6 | 2024-08-06 | Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. |
CVE-2024-28739 | High | 7.2 | 2024-08-06 | An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. |
CVE-2024-42347 | High | 7.7 | 2024-08-06 | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data t… |
CVE-2024-41677 | Medium | 6.3 | 2024-08-06 | Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik impr… |