2024 CVEs (page 237)
Page 237 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39206 | High | 7.5 | 2024-07-02 | An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings… |
CVE-2024-5866 | Medium | 5.0 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary d… |
CVE-2024-5865 | High | 7.7 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files readin… |
CVE-2024-4467 | High | 7.8 | 2024-07-02 | A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices… |
CVE-2024-3826 | | 2024-07-02 | In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality. | |
CVE-2024-39323 | High | 7.1 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, a… |
CVE-2024-39316 | Medium | 6.5 | 2024-07-02 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability e… |
CVE-2024-26314 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-25088 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-25087 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error. |
CVE-2024-25086 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-22106 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Serv… |
CVE-2024-22105 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error. |
CVE-2024-4897 | High | 8.4 | 2024-07-02 | parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python… |
CVE-2024-32932 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the web interface users credentials may be recovered by an authenticated user. |
CVE-2024-22104 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2024-22103 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2024-22102 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error. |
CVE-2024-39143 | Medium | 5.4 | 2024-07-02 | A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML… |
CVE-2024-38519 | High | 7.8 | 2024-07-02 | `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downl… |
CVE-2024-36404 | Critical | 9.8 | 2024-07-02 | GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possibl… |
CVE-2024-34122 | High | 7.8 | 2024-07-02 | Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a re… |
CVE-2024-32757 | Medium | 6.8 | 2024-07-02 | Under certain circumstances unnecessary user details are provided within system logs |
CVE-2024-32756 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the Linux users credentials may be recovered by an authenticated user. |
CVE-2024-32755 | Critical | 9.1 | 2024-07-02 | Under certain circumstances the web interface will accept characters unrelated to the expected input. |
CVE-2024-39119 | Medium | 5.4 | 2024-07-02 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-6441 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/mai… |
CVE-2024-6440 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-6439 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2024-6438 | Medium | 6.3 | 2024-07-02 | A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The… |
CVE-2024-6264 | Medium | 6.4 | 2024-07-02 | The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including… |
CVE-2024-6099 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6… |
CVE-2024-6088 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register'… |
CVE-2024-4268 | Medium | 6.4 | 2024-07-02 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to… |
CVE-2024-6012 | Medium | 4.3 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page… |
CVE-2024-6011 | Medium | 4.4 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, a… |
CVE-2024-34601 | Medium | 5.9 | 2024-07-02 | Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activi… |
CVE-2024-34600 | Medium | 4.4 | 2024-07-02 | Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to ext… |
CVE-2024-34599 | Medium | 4.0 | 2024-07-02 | Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips' privilege. |
CVE-2024-34597 | Medium | 4.4 | 2024-07-02 | Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Heal… |
CVE-2024-34596 | Medium | 5.9 | 2024-07-02 | Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. |
CVE-2024-34595 | High | 7.8 | 2024-07-02 | Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34594 | Medium | 5.5 | 2024-07-02 | Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address. |
CVE-2024-34593 | High | 7.5 | 2024-07-02 | Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary cod… |
CVE-2024-34592 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of servi… |
CVE-2024-34591 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger tempora… |
CVE-2024-34590 | Medium | 5.3 | 2024-07-02 | Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger tempora… |
CVE-2024-34589 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service… |
CVE-2024-34588 | Medium | 5.3 | 2024-07-02 | Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service… |
CVE-2024-34587 | High | 7.5 | 2024-07-02 | Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute a… |
CVE-2024-34586 | Medium | 5.9 | 2024-07-02 | Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy. |
CVE-2024-34585 | High | 7.8 | 2024-07-02 | Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34583 | Medium | 4.0 | 2024-07-02 | Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier. |
CVE-2024-20901 | Medium | 5.9 | 2024-07-02 | Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2024-20900 | Medium | 4.0 | 2024-07-02 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication. |
CVE-2024-20899 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive infor… |
CVE-2024-20898 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive in… |
CVE-2024-20897 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive infor… |
CVE-2024-20896 | Medium | 5.5 | 2024-07-02 | Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-20895 | High | 7.7 | 2024-07-02 | Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features. |
CVE-2024-20894 | Medium | 4.3 | 2024-07-02 | Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain c… |
CVE-2024-20893 | Medium | 6.1 | 2024-07-02 | Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption. |
CVE-2024-20892 | Medium | 6.5 | 2024-07-02 | Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction i… |
CVE-2024-20891 | High | 7.8 | 2024-07-02 | Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-20890 | Medium | 5.3 | 2024-07-02 | Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior. |
CVE-2024-20889 | Medium | 5.9 | 2024-07-02 | Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices. |
CVE-2024-20888 | High | 7.8 | 2024-07-02 | Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for t… |
CVE-2024-5260 | Medium | 6.4 | 2024-07-02 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-4836 | High | 7.5 | 2024-07-02 | Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration fil… |
CVE-2024-37185 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37077 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37030 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-36278 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-36260 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-36243 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds read and write. |
CVE-2024-31071 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-5545 | Medium | 5.3 | 2024-07-02 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-5544 | Medium | 6.1 | 2024-07-02 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including… |
CVE-2024-5504 | Medium | 6.4 | 2024-07-02 | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing… |
CVE-2024-3513 | Medium | 6.4 | 2024-07-02 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitleTag) parameter in a… |
CVE-2024-38857 | Medium | 4.3 | 2024-07-02 | Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can fac… |
CVE-2024-37479 | High | 8.5 | 2024-07-02 | Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "pro… |
CVE-2024-37134 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potential… |
CVE-2024-37133 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potential… |
CVE-2024-37132 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker with local access co… |
CVE-2024-37126 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could potential… |
CVE-2024-6172 | Critical | 9.8 | 2024-07-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-5219 | Medium | 6.4 | 2024-07-02 | The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and includin… |
CVE-2024-32854 | Medium | 6.7 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentiall… |
CVE-2024-32853 | Medium | 4.4 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could po… |
CVE-2024-32852 | Medium | 5.9 | 2024-07-02 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network maliciou… |
CVE-2024-0158 | Medium | 5.1 | 2024-07-02 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2024-5767 | High | 8.8 | 2024-07-02 | The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-5606 | High | 8.8 | 2024-07-02 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_que… |
CVE-2024-4627 | Medium | 5.4 | 2024-07-02 | The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settin… |
CVE-2024-3999 | Medium | 4.8 | 2024-07-02 | The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-1427 | Medium | 6.4 | 2024-07-02 | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sec… |
CVE-2024-5349 | High | 8.8 | 2024-07-02 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_s… |
CVE-2024-5419 | Medium | 6.4 | 2024-07-02 | The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribu… |
CVE-2024-5938 | Medium | 6.4 | 2024-07-02 | The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up… |