2024 CVEs (page 239)
Page 239 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21461 | High | 8.4 | 2024-07-01 | Memory corruption while performing finish HMAC operation when context is freed by keymaster. |
CVE-2024-21460 | High | 7.1 | 2024-07-01 | Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space. |
CVE-2024-21458 | Medium | 6.5 | 2024-07-01 | Information disclosure while handling SA query action frame. |
CVE-2024-21457 | Medium | 6.5 | 2024-07-01 | INformation disclosure while handling Multi-link IE in beacon frame. |
CVE-2024-21456 | Medium | 6.5 | 2024-07-01 | Information Disclosure while parsing beacon frame in STA. |
CVE-2024-6050 | Medium | 6.1 | 2024-07-01 | Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An atta… |
CVE-2024-38953 | Medium | 6.1 | 2024-07-01 | phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file. |
CVE-2024-24749 | High | 7.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Wi… |
CVE-2024-6425 | Critical | 9.1 | 2024-07-01 | Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts with… |
CVE-2024-6424 | Critical | 9.3 | 2024-07-01 | External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/P… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-4007 | High | 8.8 | 2024-07-01 | Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured. |
CVE-2024-39853 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39018 | Medium | 6.3 | 2024-07-01 | harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execut… |
CVE-2024-39017 | Critical | 9.8 | 2024-07-01 | agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute… |
CVE-2024-39016 | High | 8.1 | 2024-07-01 | che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39015 | Critical | 9.8 | 2024-07-01 | cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code… |
CVE-2024-39014 | Critical | 9.8 | 2024-07-01 | ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-39013 | Critical | 9.8 | 2024-07-01 | 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or c… |
CVE-2024-39008 | Critical | 10.0 | 2024-07-01 | robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute a… |
CVE-2024-39003 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39002 | Medium | 6.3 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitr… |
CVE-2024-39001 | Medium | 6.3 | 2024-07-01 | ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to e… |
CVE-2024-39000 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrar… |
CVE-2024-38999 | Critical | 10.0 | 2024-07-01 | jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execut… |
CVE-2024-38997 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute… |
CVE-2024-38996 | Critical | 9.8 | 2024-07-01 | ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allo… |
CVE-2024-38994 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary co… |
CVE-2024-38993 | Critical | 9.8 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-38992 | High | 8.8 | 2024-07-01 | airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitr… |
CVE-2024-38991 | High | 8.8 | 2024-07-01 | akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38990 | Medium | 6.3 | 2024-07-01 | Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-38987 | Medium | 6.3 | 2024-07-01 | aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-39430 | Medium | 5.1 | 2024-07-01 | In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executi… |
CVE-2024-39429 | Medium | 5.1 | 2024-07-01 | In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executi… |
CVE-2024-39428 | Medium | 6.8 | 2024-07-01 | In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2024-39427 | Medium | 5.1 | 2024-07-01 | In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2024-0153 | High | 7.8 | 2024-07-01 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Fir… |
CVE-2024-6130 | Medium | 4.8 | 2024-07-01 | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4934 | Medium | 5.5 | 2024-07-01 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post… |
CVE-2024-3123 | High | 7.2 | 2024-07-01 | CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can… |
CVE-2024-3122 | Medium | 4.9 | 2024-07-01 | CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privile… |
CVE-2024-38480 | Medium | 4.0 | 2024-07-01 | "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the AP… |
CVE-2024-20081 | Medium | 6.7 | 2024-07-01 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20080 | Critical | 9.8 | 2024-07-01 | In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no… |
CVE-2024-20079 | Medium | 6.7 | 2024-07-01 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20078 | Critical | 9.8 | 2024-07-01 | In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2024-20077 | High | 7.5 | 2024-07-01 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges… |
CVE-2024-20076 | High | 7.5 | 2024-07-01 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges… |
CVE-2024-6419 | Medium | 6.3 | 2024-07-01 | A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Ma… |
CVE-2024-6418 | High | 7.3 | 2024-06-30 | A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.ph… |
CVE-2024-6417 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6416 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/d… |
CVE-2024-34703 | High | 7.5 | 2024-06-30 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-28794 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2024-31898 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure dir… |
CVE-2024-28797 | Medium | 6.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-35119 | Medium | 5.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2024-31902 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2024-28798 | High | 7.2 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-5062 | Medium | 6.1 | 2024-06-30 | A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization o… |
CVE-2024-28795 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2024-6415 | Low | 2.4 | 2024-06-30 | A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /em… |
CVE-2024-6414 | Medium | 5.3 | 2024-06-30 | A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage… |
CVE-2024-5926 | Critical | 9.1 | 2024-06-30 | A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and caus… |
CVE-2024-39848 | Critical | 9.1 | 2024-06-29 | Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws… |
CVE-2024-39846 | Low | 3.5 | 2024-06-29 | NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOT… |
CVE-2024-39840 | High | 8.8 | 2024-06-29 | Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module fun… |
CVE-2024-2386 | High | 8.8 | 2024-06-29 | The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all ve… |
CVE-2024-25943 | High | 7.6 | 2024-06-29 | iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A r… |
CVE-2024-5819 | Medium | 6.4 | 2024-06-29 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data at… |
CVE-2024-6363 | Medium | 6.4 | 2024-06-29 | The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including… |
CVE-2024-5790 | Medium | 6.4 | 2024-06-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading w… |
CVE-2024-5666 | Medium | 6.4 | 2024-06-29 | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versi… |
CVE-2024-6265 | Critical | 9.8 | 2024-06-29 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2024-5942 | Medium | 4.3 | 2024-06-29 | The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone… |
CVE-2024-5889 | Medium | 6.1 | 2024-06-29 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in… |
CVE-2024-5598 | High | 7.5 | 2024-06-29 | The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_f… |
CVE-2024-5192 | Medium | 6.4 | 2024-06-29 | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPres… |
CVE-2024-6405 | Medium | 6.1 | 2024-06-29 | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing… |
CVE-2024-37371 | Critical | 9.1 | 2024-06-28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid… |
CVE-2024-39828 | Medium | 6.1 | 2024-06-28 | R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. This was fixed in a hotfix to 1.9.5 on 2024-06-29. |
CVE-2024-38533 | Medium | 6.5 | 2024-06-28 | ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access th… |
CVE-2024-38532 | High | 7.1 | 2024-06-28 | The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryp… |
CVE-2024-38525 | High | 7.5 | 2024-06-28 | dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited… |
CVE-2024-37370 | High | 7.5 | 2024-06-28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped… |
CVE-2024-39307 | Low | 3.5 | 2024-06-28 | Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't s… |
CVE-2024-39302 | Low | 3.7 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated fi… |
CVE-2024-38518 | Medium | 4.6 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick… |
CVE-2024-29040 | Medium | 4.3 | 2024-06-28 | This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to… |
CVE-2024-5827 | Critical | 9.8 | 2024-06-28 | Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and gener… |
CVE-2024-5712 | High | 8.1 | 2024-06-28 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows a… |
CVE-2024-3995 | | 2024-06-28 | In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. | |
CVE-2024-38528 | High | 7.5 | 2024-06-28 | nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. Th… |
CVE-2024-38514 | High | 7.4 | 2024-06-28 | NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET p… |
CVE-2024-38322 | Medium | 5.3 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration… |
CVE-2024-35156 | Medium | 6.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2024-35116 | Medium | 5.9 | 2024-06-28 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-For… |
CVE-2024-27629 | High | 7.8 | 2024-06-28 | An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected in… |
CVE-2024-27628 | High | 8.1 | 2024-06-28 | Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. |