2024 CVEs (page 206)
Page 206 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34607 | Medium | 6.2 | 2024-08-07 | Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the back… |
CVE-2024-34606 | Medium | 6.2 | 2024-08-07 | Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backg… |
CVE-2024-34605 | Medium | 6.2 | 2024-08-07 | Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the bac… |
CVE-2024-34604 | Medium | 6.2 | 2024-08-07 | Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the backgrou… |
CVE-2024-38206 | High | 8.5 | 2024-08-06 | An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. |
CVE-2024-38166 | High | 8.2 | 2024-08-06 | An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricki… |
CVE-2024-7550 | High | 8.8 | 2024-08-06 | Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-7536 | High | 8.8 | 2024-08-06 | Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-7535 | High | 8.8 | 2024-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-7534 | High | 8.8 | 2024-08-06 | Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-7533 | High | 8.8 | 2024-08-06 | Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2024-7532 | High | 8.8 | 2024-08-06 | Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2024-42219 | High | 7.8 | 2024-08-06 | 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient. |
CVE-2024-42218 | Medium | 4.7 | 2024-08-06 | 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms. |
CVE-2024-41270 | Critical | 9.1 | 2024-08-06 | An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version. |
CVE-2024-42400 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42399 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42398 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42397 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42396 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-42393 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-28740 | Critical | 9.6 | 2024-08-06 | Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. |
CVE-2024-28739 | High | 7.2 | 2024-08-06 | An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. |
CVE-2024-42347 | High | 7.7 | 2024-08-06 | matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data t… |
CVE-2024-41677 | Medium | 6.3 | 2024-08-06 | Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik impr… |
CVE-2024-7502 | High | 7.8 | 2024-08-06 | A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code. |
CVE-2024-42358 | Medium | 6.2 | 2024-08-06 | PDFio is a simple C library for reading and writing PDF files. There is a denial of service (DOS) vulnerability in the TTF parser. Maliciously crafted TTF file… |
CVE-2024-39229 | Medium | 5.3 | 2024-08-06 | An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300… |
CVE-2024-39227 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-7564 | Medium | 6.5 | 2024-08-06 | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-7005 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-7004 | Medium | 4.3 | 2024-08-06 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in… |
CVE-2024-7003 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-7001 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures t… |
CVE-2024-7000 | High | 8.8 | 2024-08-06 | Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially e… |
CVE-2024-6999 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-6998 | High | 8.8 | 2024-08-06 | Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to po… |
CVE-2024-6997 | High | 8.8 | 2024-08-06 | Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2024-6996 | Low | 3.1 | 2024-08-06 | Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing… |
CVE-2024-6995 | Medium | 4.7 | 2024-08-06 | Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2024-6994 | High | 8.8 | 2024-08-06 | Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-6991 | High | 8.8 | 2024-08-06 | Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-6989 | High | 8.8 | 2024-08-06 | Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-6988 | High | 8.8 | 2024-08-06 | Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-6720 | High | 8.8 | 2024-08-06 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-43113 | Medium | 6.1 | 2024-08-06 | The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129. |
CVE-2024-43112 | Medium | 6.1 | 2024-08-06 | Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129. |
CVE-2024-43111 | Medium | 6.1 | 2024-08-06 | Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129. |
CVE-2024-41616 | Critical | 9.8 | 2024-08-06 | D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service. |
CVE-2024-41333 | Medium | 6.1 | 2024-08-06 | A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of… |
CVE-2024-39751 | Medium | 4.3 | 2024-08-06 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2024-39228 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-39226 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-39225 | Critical | 9.8 | 2024-08-06 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75… |
CVE-2024-23483 | High | 7.0 | 2024-08-06 | An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on Mac… |
CVE-2024-23464 | High | 7.2 | 2024-08-06 | In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2… |
CVE-2024-23460 | Medium | 6.4 | 2024-08-06 | The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This aff… |
CVE-2024-23458 | High | 7.3 | 2024-08-06 | While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privile… |
CVE-2024-23456 | High | 7.8 | 2024-08-06 | Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enab… |
CVE-2024-7552 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression… |
CVE-2024-36424 | Medium | 5.5 | 2024-08-06 | K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference. |
CVE-2024-41913 | High | 8.8 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input. |
CVE-2024-41911 | Medium | 5.4 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web… |
CVE-2024-41910 | Medium | 6.1 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in… |
CVE-2024-41226 | High | 7.8 | 2024-08-06 | A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Autom… |
CVE-2024-40101 | Medium | 6.1 | 2024-08-06 | A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject a… |
CVE-2024-33897 | Critical | 9.1 | 2024-08-06 | A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability iss… |
CVE-2024-30170 | Critical | 9.1 | 2024-08-06 | PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major ve… |
CVE-2024-7551 | Low | 2.7 | 2024-08-06 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor… |
CVE-2024-7531 | Medium | 6.5 | 2024-08-06 | Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Fire… |
CVE-2024-7530 | High | 8.8 | 2024-08-06 | Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129. |
CVE-2024-7529 | Medium | 6.5 | 2024-08-06 | The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability… |
CVE-2024-7528 | High | 8.8 | 2024-08-06 | Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Th… |
CVE-2024-7527 | High | 8.8 | 2024-08-06 | Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ES… |
CVE-2024-7526 | Medium | 6.5 | 2024-08-06 | ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnera… |
CVE-2024-7525 | High | 8.1 | 2024-08-06 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on… |
CVE-2024-7524 | Medium | 6.1 | 2024-08-06 | Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy… |
CVE-2024-7523 | High | 8.1 | 2024-08-06 | A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only a… |
CVE-2024-7522 | High | 8.8 | 2024-08-06 | Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, F… |
CVE-2024-7521 | High | 8.8 | 2024-08-06 | Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128… |
CVE-2024-7520 | High | 8.8 | 2024-08-06 | A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox… |
CVE-2024-7519 | Critical | 9.6 | 2024-08-06 | Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox esc… |
CVE-2024-7518 | Medium | 6.5 | 2024-08-06 | Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affect… |
CVE-2024-6359 | Medium | 6.4 | 2024-08-06 | Privilege escalation vulnerability identified in OpenText ArcSight Intelligence. |
CVE-2024-6358 | Medium | 6.3 | 2024-08-06 | Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence. |
CVE-2024-6357 | Medium | 6.3 | 2024-08-06 | Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence. |
CVE-2024-43114 | High | 7.5 | 2024-08-06 | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions |
CVE-2024-33994 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it… |
CVE-2024-33993 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it… |
CVE-2024-33992 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a spe… |
CVE-2024-33991 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a spe… |
CVE-2024-33990 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a spe… |
CVE-2024-33989 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a spe… |
CVE-2024-33988 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could cre… |
CVE-2024-33987 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could cre… |
CVE-2024-33986 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could cre… |
CVE-2024-33985 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could cre… |
CVE-2024-33984 | High | 7.1 | 2024-08-06 | Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could cre… |