2024 CVEs (page 228)
Page 228 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39499 | High | 7.1 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted t… |
CVE-2024-39498 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 [Why] Commit: - commit… |
CVE-2024-39497 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Lack of check for copy-on… |
CVE-2024-39496 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info… |
CVE-2024-39495 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_inte… |
CVE-2024-39494 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and t… |
CVE-2024-39340 | High | 8.8 | 2024-07-12 | The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the adm… |
CVE-2024-36522 | Critical | 9.8 | 2024-07-12 | The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source w… |
CVE-2024-6328 | Critical | 9.8 | 2024-07-12 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-6353 | High | 8.8 | 2024-07-12 | The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 du… |
CVE-2024-6625 | Medium | 5.5 | 2024-07-12 | The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve… |
CVE-2024-6588 | Medium | 6.4 | 2024-07-12 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions… |
CVE-2024-6555 | Medium | 5.3 | 2024-07-12 | The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due t… |
CVE-2024-6024 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged i… |
CVE-2024-6023 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perf… |
CVE-2024-6022 | High | 8.8 | 2024-07-12 | The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-5811 | Medium | 5.4 | 2024-07-12 | The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perfor… |
CVE-2024-5626 | Medium | 6.1 | 2024-07-12 | The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-4753 | Medium | 4.8 | 2024-07-12 | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-3112 | Medium | 4.8 | 2024-07-12 | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to… |
CVE-2024-2696 | Medium | 4.8 | 2024-07-12 | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-2640 | Medium | 5.4 | 2024-07-12 | The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been autho… |
CVE-2024-2430 | Medium | 5.4 | 2024-07-12 | The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2024-0974 | Medium | 4.8 | 2024-07-12 | The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-6677 | High | 7.8 | 2024-07-12 | Privilege escalation in uberAgent |
CVE-2024-1375 | Medium | 4.3 | 2024-07-12 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versi… |
CVE-2024-6396 | Critical | 9.8 | 2024-07-12 | A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate ar… |
CVE-2024-6392 | Medium | 5.4 | 2024-07-11 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on… |
CVE-2024-6468 | High | 7.5 | 2024-07-11 | Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, w… |
CVE-2024-36435 | Critical | 9.8 | 2024-07-11 | An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can… |
CVE-2024-6681 | Medium | 6.3 | 2024-07-11 | A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown func… |
CVE-2024-6485 | Medium | 6.4 | 2024-07-11 | A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-l… |
CVE-2024-39553 | Medium | 6.5 | 2024-07-11 | An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based atta… |
CVE-2024-39552 | High | 7.5 | 2024-07-11 | An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a ne… |
CVE-2024-39551 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of Juniper Networks Junos OS on SRX Series and MX Series with… |
CVE-2024-39550 | Medium | 6.5 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthen… |
CVE-2024-39549 | High | 7.5 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2024-39548 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacke… |
CVE-2024-39546 | High | 7.3 | 2024-07-11 | A Missing Authorization vulnerability in the Socket Intercept (SI) command file interface of Juniper Networks Junos OS Evolved allows an authenticated, low-pri… |
CVE-2024-39545 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with S… |
CVE-2024-39543 | Medium | 6.5 | 2024-07-11 | A Buffer Copy without Checking Size of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evol… |
CVE-2024-39542 | High | 7.5 | 2024-07-11 | An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MPC… |
CVE-2024-39541 | Medium | 6.5 | 2024-07-11 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an u… |
CVE-2024-39540 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on SRX Series, and MX… |
CVE-2024-39539 | Medium | 5.3 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cau… |
CVE-2024-39538 | Medium | 6.5 | 2024-07-11 | A Buffer Copy without Checking Size of Input vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7000 Series al… |
CVE-2024-39537 | Medium | 6.5 | 2024-07-11 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthen… |
CVE-2024-39536 | Medium | 5.3 | 2024-07-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the Periodic Packet Management Daemon (ppmd) of Juniper Networks Junos OS and Junos OS Ev… |
CVE-2024-39535 | Medium | 6.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Se… |
CVE-2024-39533 | Medium | 5.8 | 2024-07-11 | An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an unauthenticated, net… |
CVE-2024-39532 | Medium | 6.3 | 2024-07-11 | An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with… |
CVE-2024-39531 | High | 7.5 | 2024-07-11 | An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-bas… |
CVE-2024-6680 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-39905 | Medium | 5.3 | 2024-07-11 | Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without… |
CVE-2024-39904 | High | 8.8 | 2024-07-11 | VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on t… |
CVE-2024-39530 | High | 7.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauth… |
CVE-2024-39529 | High | 7.5 | 2024-07-11 | A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthent… |
CVE-2024-39528 | Medium | 5.7 | 2024-07-11 | A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based at… |
CVE-2024-39524 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39523 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39522 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39521 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39520 | High | 7.8 | 2024-07-11 | An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low priv… |
CVE-2024-39519 | Medium | 6.5 | 2024-07-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Ser… |
CVE-2024-39317 | Medium | 6.5 | 2024-07-11 | Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process s… |
CVE-2024-32753 | | 2024-07-11 | Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component | |
CVE-2024-6679 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role… |
CVE-2024-38536 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to `http… |
CVE-2024-38535 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out of memory when parsi… |
CVE-2024-38534 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimi… |
CVE-2024-37151 | Medium | 5.3 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packe… |
CVE-2024-28872 | High | 8.9 | 2024-07-11 | The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once th… |
CVE-2024-6035 | Medium | 6.1 | 2024-07-11 | A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malici… |
CVE-2024-6407 | Critical | 9.8 | 2024-07-11 | CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. |
CVE-2024-6528 | Medium | 5.4 | 2024-07-11 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a… |
CVE-2024-5681 | High | 7.8 | 2024-07-11 | CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a… |
CVE-2024-5680 | High | 7.1 | 2024-07-11 | CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts… |
CVE-2024-5679 | High | 7.1 | 2024-07-11 | CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access… |
CVE-2024-2602 | High | 7.3 | 2024-07-11 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an… |
CVE-2024-38433 | Medium | 6.7 | 2024-07-11 | Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton… |
CVE-2024-6666 | High | 8.8 | 2024-07-11 | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to i… |
CVE-2024-6624 | Critical | 9.8 | 2024-07-11 | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on c… |
CVE-2024-6385 | Critical | 9.6 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-6256 | Medium | 6.4 | 2024-07-11 | The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-5257 | Medium | 4.9 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `ad… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-6138 | Medium | 4.8 | 2024-07-11 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6026 | Medium | 5.4 | 2024-07-11 | The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access t… |
CVE-2024-6025 | Medium | 5.4 | 2024-07-11 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and high… |
CVE-2024-5444 | Medium | 5.4 | 2024-07-11 | The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2024-4655 | Medium | 5.4 | 2024-07-11 | The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2024-1845 | High | 8.8 | 2024-07-11 | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged… |
CVE-2024-22280 | High | 8.5 | 2024-07-11 | VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter speci… |
CVE-2024-6554 | Medium | 5.3 | 2024-07-11 | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-0619 | Medium | 5.3 | 2024-07-11 | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback()… |
CVE-2024-6676 | Medium | 6.3 | 2024-07-11 | A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-6210 | Medium | 5.3 | 2024-07-11 | The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticat… |
CVE-2024-23485 | Medium | 4.6 | 2024-07-11 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to sec… |