2024 CVEs (page 224)
Page 224 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21144 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affecte… |
CVE-2024-21143 | Medium | 5.3 | 2024-07-16 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions that are affected are 12.2.3-12.2.13. E… |
CVE-2024-21142 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.37 and prior… |
CVE-2024-21141 | High | 8.2 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily… |
CVE-2024-21140 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21139 | Medium | 5.4 | 2024-07-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). Supported versions that a… |
CVE-2024-21138 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21137 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-21136 | High | 8.6 | 2024-07-16 | Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5… |
CVE-2024-21135 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0… |
CVE-2024-21134 | Medium | 4.3 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 8.0.37 and prior… |
CVE-2024-21133 | Medium | 6.1 | 2024-07-16 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Servlet). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2024-21132 | Medium | 5.4 | 2024-07-16 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.13. Eas… |
CVE-2024-21131 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21130 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21129 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and p… |
CVE-2024-21128 | Medium | 5.4 | 2024-07-16 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12.2.6-1… |
CVE-2024-21127 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and p… |
CVE-2024-21126 | Medium | 5.8 | 2024-07-16 | Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.23 and 21.3-2… |
CVE-2024-21125 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and p… |
CVE-2024-21123 | Low | 2.3 | 2024-07-16 | Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnera… |
CVE-2024-21122 | Medium | 5.4 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog). The supported version that is affect… |
CVE-2024-20996 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-6779 | Critical | 9.6 | 2024-07-16 | Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2024-6778 | High | 7.5 | 2024-07-16 | Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML i… |
CVE-2024-6777 | Medium | 6.5 | 2024-07-16 | Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2024-6776 | High | 8.8 | 2024-07-16 | Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-6775 | High | 8.8 | 2024-07-16 | Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2024-6774 | High | 8.8 | 2024-07-16 | Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2024-6773 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-6772 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2024-6395 | Medium | 5.3 | 2024-07-16 | An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that util… |
CVE-2024-6336 | Medium | 5.3 | 2024-07-16 | A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise Serve… |
CVE-2024-5817 | Medium | 6.5 | 2024-07-16 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was onl… |
CVE-2024-5816 | Medium | 5.3 | 2024-07-16 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via… |
CVE-2024-5815 | Medium | 6.5 | 2024-07-16 | A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request ty… |
CVE-2024-5795 | High | 7.7 | 2024-07-16 | A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large… |
CVE-2024-5566 | Medium | 5.8 | 2024-07-16 | An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal… |
CVE-2024-40536 | Medium | 5.3 | 2024-07-16 | Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 were discovered to contain a stack overflow via the pin_3g_code parameter in the config_3g_para functio… |
CVE-2024-40535 | Critical | 9.8 | 2024-07-16 | Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apn_name_3g parameter in the config_3g_para function. |
CVE-2024-21687 | High | 8.1 | 2024-07-16 | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server… |
CVE-2024-40515 | Critical | 9.8 | 2024-07-16 | An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality. |
CVE-2024-40505 | Critical | 9.3 | 2024-07-16 | Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component. |
CVE-2024-40456 | Critical | 9.8 | 2024-07-16 | ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php. |
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |
CVE-2024-21686 | High | 8.7 | 2024-07-16 | This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS S… |
CVE-2024-6492 | High | 7.4 | 2024-07-16 | Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an atta… |
CVE-2024-40516 | High | 8.8 | 2024-07-16 | An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality. |
CVE-2024-40503 | Medium | 6.5 | 2024-07-16 | An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling. |
CVE-2024-40394 | Critical | 9.8 | 2024-07-16 | Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php. |
CVE-2024-40393 | Critical | 9.8 | 2024-07-16 | Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php. |
CVE-2024-40392 | Critical | 9.8 | 2024-07-16 | SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injecti… |
CVE-2024-40130 | Critical | 9.8 | 2024-07-16 | open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c. |
CVE-2024-40129 | Critical | 9.8 | 2024-07-16 | Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c. |
CVE-2024-39036 | Medium | 6.5 | 2024-07-16 | SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. |
CVE-2024-40425 | Critical | 9.8 | 2024-07-16 | File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary co… |
CVE-2024-39908 | Medium | 4.3 | 2024-07-16 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`… |
CVE-2024-39700 | Critical | 9.9 | 2024-07-16 | JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-in… |
CVE-2024-33181 | High | 8.8 | 2024-07-16 | Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceMac parameter at ip/goform/addWifiMacFilter. |
CVE-2024-6326 | Medium | 5.5 | 2024-07-16 | An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerabi… |
CVE-2024-6325 | Medium | 6.5 | 2024-07-16 | The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/a… |
CVE-2024-6089 | High | 7.5 | 2024-07-16 | An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to resu… |
CVE-2024-40626 | High | 7.3 | 2024-07-16 | Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site… |
CVE-2024-3232 | High | 7.6 | 2024-07-16 | A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate ap… |
CVE-2024-40322 | High | 8.8 | 2024-07-16 | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
CVE-2024-35338 | Critical | 9.8 | 2024-07-16 | Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root. |
CVE-2024-33182 | Critical | 9.8 | 2024-07-16 | Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/addWifiMacFilter. |
CVE-2024-33180 | Critical | 9.8 | 2024-07-16 | Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/saveParentControlInfo. |
CVE-2024-22442 | Critical | 9.8 | 2024-07-16 | The vulnerability could be remotely exploited to bypass authentication. |
CVE-2024-6655 | High | 7.0 | 2024-07-16 | A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working dire… |
CVE-2024-32861 | High | 7.8 | 2024-07-16 | Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions. |
CVE-2024-6435 | High | 8.8 | 2024-07-16 | A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should… |
CVE-2024-6621 | Medium | 4.3 | 2024-07-16 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a mi… |
CVE-2024-6457 | Critical | 9.8 | 2024-07-16 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all… |
CVE-2024-6579 | Medium | 4.3 | 2024-07-16 | The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability… |
CVE-2024-39887 | Medium | 4.3 | 2024-07-16 | An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-… |
CVE-2024-6570 | Medium | 5.3 | 2024-07-16 | The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk a… |
CVE-2024-6565 | Medium | 5.3 | 2024-07-16 | The AForms — Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-5852 | Medium | 4.3 | 2024-07-16 | The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter… |
CVE-2024-3779 | Medium | 6.1 | 2024-07-16 | Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inoper… |
CVE-2024-3587 | Medium | 6.4 | 2024-07-16 | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all… |
CVE-2024-2691 | Medium | 6.4 | 2024-07-16 | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2024-1937 | High | 7.1 | 2024-07-16 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' functio… |
CVE-2024-41008 | High | 7.8 | 2024-07-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm->task_info handling This patch changes the handling and lifecycle o… |
CVE-2024-6559 | Medium | 5.3 | 2024-07-16 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and i… |
CVE-2024-4780 | Medium | 6.4 | 2024-07-16 | The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to… |
CVE-2024-6557 | Medium | 5.3 | 2024-07-16 | The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vul… |
CVE-2024-6780 | Low | 3.3 | 2024-07-16 | Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. |
CVE-2024-40524 | Critical | 9.8 | 2024-07-15 | Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py component. |
CVE-2024-4143 | Critical | 9.8 | 2024-07-15 | A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released f… |
CVE-2024-40632 | Low | 3.7 | 2024-07-15 | Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptibl… |
CVE-2024-4224 | Medium | 5.4 | 2024-07-15 | An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could a… |
CVE-2024-40630 | Medium | 4.3 | 2024-07-15 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with… |
CVE-2024-40627 | Medium | 5.8 | 2024-07-15 | Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack au… |
CVE-2024-40624 | Critical | 9.8 | 2024-07-15 | TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses th… |
CVE-2024-39919 | Low | 3.1 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-39918 | Medium | 4.3 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-39915 | Critical | 9.9 | 2024-07-15 | Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authori… |
CVE-2024-39912 | Medium | 5.3 | 2024-07-15 | web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web… |
CVE-2024-38360 | Medium | 4.9 | 2024-07-15 | Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters… |