2024 CVEs (page 228)
Page 228 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40915 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context __kernel_map_pages… |
CVE-2024-40914 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently… |
CVE-2024-40913 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds After installing t… |
CVE-2024-40912 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_de… |
CVE-2024-40911 | High | 8.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling… |
CVE-2024-40910 | High | 8.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_relea… |
CVE-2024-40909 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free in bpf_link_free() After commit 1a80dbcb2dba, bpf_lin… |
CVE-2024-40908 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback syzbot reported crash when rawtp program… |
CVE-2024-40907 | Critical | 9.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX action In the XDP_TX path, ionic driver sends a packet… |
CVE-2024-40906 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails… |
CVE-2024-40905 | Medium | 4.7 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcp… |
CVE-2024-40904 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer fo… |
CVE-2024-40903 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps There could be a p… |
CVE-2024-40902 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expec… |
CVE-2024-40901 | High | 7.3 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potentia… |
CVE-2024-40900 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEA… |
CVE-2024-40899 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() We got the following… |
CVE-2024-39510 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the follo… |
CVE-2024-39509 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning [1] in a c… |
CVE-2024-39508 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags Utilize set_bit() and test_… |
CVE-2024-39507 | High | 7.0 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash problem in concurrent scenario When link status change, the n… |
CVE-2024-39506 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet In lio_vf_rep_cop… |
CVE-2024-39505 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komeda_pipeline_get_state() may return an erro… |
CVE-2024-39504 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: validate mandatory meta and payload Check for mandatory netlink att… |
CVE-2024-39503 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ack… |
CVE-2024-39502 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_… |
CVE-2024-39500 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put sk_psock_get will return NUL… |
CVE-2024-39499 | High | 7.1 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted t… |
CVE-2024-39498 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 [Why] Commit: - commit… |
CVE-2024-39497 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Lack of check for copy-on… |
CVE-2024-39496 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info… |
CVE-2024-39495 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_inte… |
CVE-2024-39494 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and t… |
CVE-2024-39340 | High | 8.8 | 2024-07-12 | The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the adm… |
CVE-2024-36522 | Critical | 9.8 | 2024-07-12 | The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source w… |
CVE-2024-6328 | Critical | 9.8 | 2024-07-12 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-6353 | High | 8.8 | 2024-07-12 | The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 du… |
CVE-2024-6625 | Medium | 5.5 | 2024-07-12 | The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve… |
CVE-2024-6588 | Medium | 6.4 | 2024-07-12 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions… |
CVE-2024-6555 | Medium | 5.3 | 2024-07-12 | The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due t… |
CVE-2024-6024 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged i… |
CVE-2024-6023 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perf… |
CVE-2024-6022 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-5811 | Medium | 5.4 | 2024-07-12 | The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perfor… |
CVE-2024-5626 | Medium | 6.1 | 2024-07-12 | The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-4753 | Medium | 4.8 | 2024-07-12 | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-3112 | Medium | 4.8 | 2024-07-12 | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to… |
CVE-2024-2696 | Medium | 4.8 | 2024-07-12 | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-2640 | Medium | 5.4 | 2024-07-12 | The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been autho… |
CVE-2024-2430 | Medium | 5.4 | 2024-07-12 | The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2024-0974 | Medium | 4.8 | 2024-07-12 | The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-6677 | High | 7.8 | 2024-07-12 | Privilege escalation in uberAgent |
CVE-2024-1375 | Medium | 4.3 | 2024-07-12 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versi… |
CVE-2024-6396 | Critical | 9.8 | 2024-07-12 | A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate ar… |
CVE-2024-6392 | Medium | 5.4 | 2024-07-11 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on… |
CVE-2024-6468 | High | 7.5 | 2024-07-11 | Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, w… |
CVE-2024-36435 | Critical | 9.8 | 2024-07-11 | An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can… |
CVE-2024-6681 | Medium | 6.3 | 2024-07-11 | A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown func… |
CVE-2024-6485 | Medium | 6.4 | 2024-07-11 | A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-l… |
CVE-2024-39553 | Medium | 6.5 | 2024-07-11 | An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based atta… |
CVE-2024-39552 | High | 7.5 | 2024-07-11 | An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a ne… |
CVE-2024-39551 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of Juniper Networks Junos OS on SRX Series and MX Series with… |
CVE-2024-39550 | Medium | 6.5 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthen… |
CVE-2024-39549 | High | 7.5 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2024-39548 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacke… |
CVE-2024-39546 | High | 7.3 | 2024-07-11 | A Missing Authorization vulnerability in the Socket Intercept (SI) command file interface of Juniper Networks Junos OS Evolved allows an authenticated, low-pri… |
CVE-2024-39545 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with S… |
CVE-2024-39543 | Medium | 6.5 | 2024-07-11 | A Buffer Copy without Checking Size of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evol… |
CVE-2024-39542 | High | 7.5 | 2024-07-11 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MPC… |
CVE-2024-39541 | Medium | 6.5 | 2024-07-11 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an u… |
CVE-2024-39540 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on SRX Series, and MX… |
CVE-2024-39539 | Medium | 5.3 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cau… |
CVE-2024-39538 | Medium | 6.5 | 2024-07-11 | A Buffer Copy without Checking Size of Input vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7000 Series al… |
CVE-2024-39537 | Medium | 6.5 | 2024-07-11 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthen… |
CVE-2024-39536 | Medium | 5.3 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the Periodic Packet Management Daemon (ppmd) of Juniper Networks Junos OS and Junos OS Ev… |
CVE-2024-39535 | Medium | 6.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Se… |
CVE-2024-39533 | Medium | 5.8 | 2024-07-11 | An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an unauthenticated, net… |
CVE-2024-39532 | Medium | 6.3 | 2024-07-11 | An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with… |
CVE-2024-39531 | High | 7.5 | 2024-07-11 | An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-bas… |
CVE-2024-6680 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-39905 | Medium | 5.3 | 2024-07-11 | Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without… |
CVE-2024-39904 | High | 8.8 | 2024-07-11 | VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on t… |
CVE-2024-39530 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauth… |
CVE-2024-39529 | High | 7.5 | 2024-07-11 | A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthent… |
CVE-2024-39528 | Medium | 5.7 | 2024-07-11 | A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based at… |
CVE-2024-39524 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39523 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39522 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39521 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39520 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39519 | Medium | 6.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Ser… |
CVE-2024-39317 | Medium | 6.5 | 2024-07-11 | Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process s… |
CVE-2024-32753 | | 2024-07-11 | Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component | |
CVE-2024-6679 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role… |
CVE-2024-38536 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to `http… |
CVE-2024-38535 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out of memory when parsi… |
CVE-2024-38534 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimi… |
CVE-2024-37151 | Medium | 5.3 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packe… |
CVE-2024-28872 | High | 8.9 | 2024-07-11 | The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once th… |
CVE-2024-6035 | Medium | 6.1 | 2024-07-11 | A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malici… |