2024 CVEs (page 212)
Page 212 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41610 | Critical | 9.8 | 2024-07-30 | D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet serv… |
CVE-2024-39012 | Critical | 9.8 | 2024-07-30 | ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitra… |
CVE-2024-39011 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via… |
CVE-2024-39010 | Critical | 9.8 | 2024-07-30 | chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to ex… |
CVE-2024-38986 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge me… |
CVE-2024-38984 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property. |
CVE-2024-36572 | Critical | 9.8 | 2024-07-30 | Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and… |
CVE-2024-5250 | Low | 3.5 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations |
CVE-2024-5249 | Medium | 5.4 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. |
CVE-2024-41443 | Medium | 5.5 | 2024-07-30 | A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. |
CVE-2024-41440 | Medium | 6.2 | 2024-07-30 | A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. |
CVE-2024-41439 | Medium | 5.5 | 2024-07-30 | A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG… |
CVE-2024-41438 | Medium | 6.2 | 2024-07-30 | A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG… |
CVE-2024-41437 | Medium | 5.5 | 2024-07-30 | A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted P… |
CVE-2024-3930 | Medium | 6.3 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. |
CVE-2024-41943 | Medium | 4.6 | 2024-07-30 | I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. A… |
CVE-2024-41305 | Medium | 4.7 | 2024-07-30 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection… |
CVE-2024-41304 | Medium | 5.4 | 2024-07-30 | An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2024-7297 | High | 8.8 | 2024-07-30 | Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privilege… |
CVE-2024-7209 | Medium | 6.5 | 2024-07-30 | A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoo… |
CVE-2024-7208 | Medium | 6.5 | 2024-07-30 | A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided… |
CVE-2024-5486 | Medium | 5.8 | 2024-07-30 | A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext fo… |
CVE-2024-41944 | Medium | 6.5 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This… |
CVE-2024-41916 | Medium | 6.8 | 2024-07-30 | A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext fo… |
CVE-2024-41915 | High | 7.2 | 2024-07-30 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2024-41804 | Medium | 6.5 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet… |
CVE-2024-41803 | Medium | 4.9 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. T… |
CVE-2024-41802 | High | 8.1 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. T… |
CVE-2024-4188 | | 2024-07-30 | Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from… | |
CVE-2024-41109 | Medium | 6.3 | 2024-07-30 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes inf… |
CVE-2024-39320 | Medium | 6.1 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypass… |
CVE-2024-37299 | Medium | 4.9 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availabil… |
CVE-2024-37165 | Medium | 6.3 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some si… |
CVE-2024-38909 | Critical | 9.8 | 2024-07-30 | Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrar… |
CVE-2024-23091 | High | 7.5 | 2024-07-30 | Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. |
CVE-2024-6699 | Critical | 9.8 | 2024-07-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection… |
CVE-2024-7127 | Medium | 6.1 | 2024-07-30 | Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting (XSS) attack. By subm… |
CVE-2024-41702 | Critical | 9.8 | 2024-07-30 | SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2024-41701 | Medium | 5.3 | 2024-07-30 | AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-7226 | Medium | 4.3 | 2024-07-30 | A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-7225 | Low | 3.5 | 2024-07-30 | A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /S… |
CVE-2024-41924 | High | 7.2 | 2024-07-30 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtaine… |
CVE-2024-41696 | High | 7.5 | 2024-07-30 | Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41695 | High | 7.5 | 2024-07-30 | Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory |
CVE-2024-41694 | Medium | 5.3 | 2024-07-30 | Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41693 | Medium | 6.1 | 2024-07-30 | Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-41141 | Medium | 6.1 | 2024-07-30 | Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs… |
CVE-2024-40895 | Medium | 6.4 | 2024-07-30 | FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execut… |
CVE-2024-38432 | Medium | 5.5 | 2024-07-30 | Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File |
CVE-2024-38431 | Medium | 5.3 | 2024-07-30 | Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy |
CVE-2024-38430 | Medium | 5.4 | 2024-07-30 | Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-38429 | High | 7.5 | 2024-07-30 | Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties |
CVE-2024-7224 | Medium | 6.3 | 2024-07-30 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this issue is some unknown functional… |
CVE-2024-7223 | Medium | 6.3 | 2024-07-30 | A vulnerability has been found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-42231 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix calc_available_free_space() for zoned mode calc_available_free_space()… |
CVE-2024-42230 | Medium | 4.4 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (relo… |
CVE-2024-42229 | Medium | 4.1 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies tha… |
CVE-2024-42228 | High | 7.0 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize t… |
CVE-2024-42227 | Medium | 4.7 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix overlapping copy within dml_core_mode_programming [WHY] &mode_lib->m… |
CVE-2024-42225 | High | 8.3 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data |
CVE-2024-42224 | High | 7.0 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 ("net: dsa: m… |
CVE-2024-42223 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up to 16M, so… |
CVE-2024-42162 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: gve: Account for stopped queues when reading NIC stats We now account for the fact that t… |
CVE-2024-42161 | Medium | 6.3 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a defau… |
CVE-2024-42160 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fs_build_fault_attr() - It missed to check val… |
CVE-2024-42159 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise num_phys Information is stored in mr_sas_port->phy_mask, values la… |
CVE-2024-42158 | Medium | 4.1 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() an… |
CVE-2024-42157 | Medium | 4.1 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copy… |
CVE-2024-42156 | Medium | 4.1 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from st… |
CVE-2024-42155 | Low | 1.9 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither pr… |
CVE-2024-42154 | Medium | 4.4 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_A… |
CVE-2024-42153 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr When del_timer… |
CVE-2024-42152 | High | 7.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destro… |
CVE-2024-42151 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable Test case dummy_st_ops/dummy_… |
CVE-2024-42150 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: remove separate irq request for MSI and INTx When using MSI or INTx interrupt… |
CVE-2024-42149 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: fs: don't misleadingly warn during thaw operations The block device may have been frozen… |
CVE-2024-42148 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occur when us… |
CVE-2024-42147 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/debugfs - Fix debugfs uninit process issue During the zip probe process… |
CVE-2024-42146 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf Any kunit doing any m… |
CVE-2024-42145 | High | 7.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which m… |
CVE-2024-42144 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data Verify that lvts_data… |
CVE-2024-42142 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-switch, Create ingress ACL when needed Currently, ingress acl is used for thr… |
CVE-2024-42141 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Check socket flag instead of hcon This fixes the following Smatch static… |
CVE-2024-42140 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: riscv: kexec: Avoid deadlock in kexec crash path If the kexec crash code is called in the… |
CVE-2024-42139 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper extts handling Extts events are disabled and enabled by the application… |
CVE-2024-42138 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file In case… |
CVE-2024-42137 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be… |
CVE-2024-42136 | High | 7.8 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syz… |
CVE-2024-42135 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: vhost_task: Handle SIGKILL by flushing work and exiting Instead of lingering until the de… |
CVE-2024-42134 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Check if is_avq is NULL [bug] In the virtio_pci_common.c function vp_del_vqs… |
CVE-2024-42133 | High | 7.6 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hci_le_big_sync_established_evt is neces… |
CVE-2024-42132 | High | 7.6 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX Syzbot hit warning… |
CVE-2024-42131 | Medium | 4.4 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed… |
CVE-2024-42129 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devm_mutex_init() for mutex initialization In this driver LEDs are regi… |
CVE-2024-42128 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: leds: an30259a: Use devm_mutex_init() for mutex initialization In this driver LEDs are re… |
CVE-2024-42127 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix shared irq handling on driver remove lima uses a shared interrupt, so the i… |
CVE-2024-42126 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. nmi_enter()/nmi_exit() touches… |
CVE-2024-42125 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband We have some p… |
CVE-2024-42124 | Medium | 5.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Make qedf_execute_tmf() non-preemptible Stop calling smp_processor_id() from… |
CVE-2024-42123 | High | 7.0 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix double free err_addr pointer warnings In amdgpu_umc_bad_page_polling_time… |