2024 CVEs (page 242)
Page 242 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29176 | High | 8.8 | 2024-06-26 | Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. A low privileged attacker with remote acc… |
CVE-2024-29175 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthen… |
CVE-2024-29174 | Medium | 4.4 | 2024-06-26 | Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potenti… |
CVE-2024-29173 | Medium | 6.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote hig… |
CVE-2024-28973 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privi… |
CVE-2024-5173 | Medium | 6.4 | 2024-06-26 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versi… |
CVE-2024-24764 | Low | 3.5 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted… |
CVE-2024-5460 | High | 8.1 | 2024-06-26 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow… |
CVE-2024-4869 | High | 7.2 | 2024-06-26 | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all version… |
CVE-2024-38526 | High | 7.2 | 2024-06-26 | pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CD… |
CVE-2024-38364 | Low | 2.6 | 2024-06-26 | DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable acces… |
CVE-2024-29954 | Medium | 5.9 | 2024-06-26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fil… |
CVE-2024-29953 | Medium | 4.3 | 2024-06-26 | A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual F… |
CVE-2024-6060 | | 2024-06-25 | An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain… | |
CVE-2024-37742 | High | 8.2 | 2024-06-25 | Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode… |
CVE-2024-35527 | Critical | 9.8 | 2024-06-25 | An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrar… |
CVE-2024-30931 | Medium | 6.1 | 2024-06-25 | Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications… |
CVE-2024-30112 | Medium | 5.4 | 2024-06-25 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2024-5019 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.Cach… |
CVE-2024-5018 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNM… |
CVE-2024-5017 | Medium | 6.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport… |
CVE-2024-5016 | High | 7.2 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code… |
CVE-2024-5015 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low pri… |
CVE-2024-5014 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticate… |
CVE-2024-5013 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the… |
CVE-2024-5012 | High | 8.6 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unau… |
CVE-2024-38516 | High | 8.8 | 2024-06-25 | ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This is… |
CVE-2024-37855 | High | 8.4 | 2024-06-25 | An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via t… |
CVE-2024-37843 | Critical | 9.8 | 2024-06-25 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. |
CVE-2024-35526 | Medium | 5.9 | 2024-06-25 | An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory. |
CVE-2024-34400 | Medium | 6.1 | 2024-06-25 | An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. There is /_layouts/15/Virto.KanbanTaskManager/api/Kanb… |
CVE-2024-21741 | Critical | 9.8 | 2024-06-25 | GigaDevice GD32E103C8T6 devices have Incorrect Access Control. |
CVE-2024-21740 | High | 7.4 | 2024-06-25 | Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. |
CVE-2024-21739 | Medium | 5.3 | 2024-06-25 | Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control. |
CVE-2024-6206 | High | 7.5 | 2024-06-25 | A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat a… |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-5011 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request … |
CVE-2024-5010 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP req… |
CVE-2024-5009 | High | 8.4 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows loc… |
CVE-2024-5008 | High | 8.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Ar… |
CVE-2024-4885 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtiliti… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2024-4498 | High | 7.7 | 2024-06-25 | A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vuln… |
CVE-2024-37894 | Medium | 6.3 | 2024-06-25 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is suscepti… |
CVE-2024-37167 | Medium | 4.3 | 2024-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see… |
CVE-2024-37820 | Medium | 5.4 | 2024-06-25 | A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation. |
CVE-2024-36819 | Medium | 5.4 | 2024-06-25 | MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client… |
CVE-2024-6308 | High | 7.3 | 2024-06-25 | A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-6257 | High | 8.4 | 2024-06-25 | HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary… |
CVE-2024-6238 | High | 7.4 | 2024-06-25 | pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on t… |
CVE-2024-5990 | High | 7.5 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ an… |
CVE-2024-5989 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote c… |
CVE-2024-5988 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote cod… |
CVE-2024-0171 | Medium | 5.3 | 2024-06-25 | Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gai… |
CVE-2024-5806 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-5805 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0. |
CVE-2024-39471 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return… |
CVE-2024-39470 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix a possible null pointer dereference in eventfs_find_events() In function eve… |
CVE-2024-39469 | High | 7.1 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling… |
CVE-2024-39468 | High | 7.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling… |
CVE-2024-39467 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kern… |
CVE-2024-39466 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/qcom/lmh: Check for SCM availability at probe Up until now, the necessary… |
CVE-2024-39465 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: media: mgb4: Fix double debugfs remove Fixes an error where debugfs_remove_recursive() is… |
CVE-2024-39464 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix notifier list entry init struct v4l2_async_notifier has several li… |
CVE-2024-39463 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_… |
CVE-2024-39462 | Critical | 9.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate st… |
CVE-2024-39461 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate st… |
CVE-2024-39371 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it wa… |
CVE-2024-39301 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/9p: fix uninit-value in p9_client_rpc() Syzbot with the help of KMSAN reported the fo… |
CVE-2024-39298 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I di… |
CVE-2024-39296 | Medium | 4.7 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix oops during rmmod "rmmod bonding" causes an oops ever since commit cc317ea3d… |
CVE-2024-39293 | Critical | 9.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2… |
CVE-2024-39276 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() Syzbot reports… |
CVE-2024-38661 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: s390/ap: Fix crash in AP internal function modify_bitmap() A system crash like this Fa… |
CVE-2024-38385 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() irq_find_at_or_after() d… |
CVE-2024-38306 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: protect folio::private when attaching extent buffer folios [BUG] Since v6.8 there… |
CVE-2024-37354 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seei… |
CVE-2024-37087 | Medium | 5.3 | 2024-06-25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. |
CVE-2024-37086 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapsh… |
CVE-2024-37085 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX… |
CVE-2024-37078 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes… |
CVE-2024-5451 | Medium | 6.4 | 2024-06-25 | The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plug… |
CVE-2024-38952 | High | 7.5 | 2024-06-25 | PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp. |
CVE-2024-38951 | Medium | 6.5 | 2024-06-25 | A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message. |
CVE-2024-32111 | Medium | 5.0 | 2024-06-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue… |
CVE-2024-21827 | High | 7.2 | 2024-06-25 | A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A s… |
CVE-2024-6303 | Critical | 9.9 | 2024-06-25 | Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege… |
CVE-2024-6302 | High | 8.1 | 2024-06-25 | Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same… |
CVE-2024-6301 | Medium | 5.3 | 2024-06-25 | Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |
CVE-2024-6299 | Medium | 4.8 | 2024-06-25 | Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the r… |
CVE-2024-5261 | Critical | 9.8 | 2024-06-25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for acce… |
CVE-2024-4846 | Medium | 6.3 | 2024-06-25 | Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without… |
CVE-2024-31111 | Medium | 6.5 | 2024-06-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue… |
CVE-2024-28832 | Medium | 4.8 | 2024-06-25 | Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Setti… |
CVE-2024-28831 | Medium | 5.4 | 2024-06-25 | Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML ele… |
CVE-2024-6307 | Medium | 6.4 | 2024-06-25 | WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outp… |
CVE-2024-5216 | High | 7.5 | 2024-06-25 | A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue… |
CVE-2024-4641 | Medium | 6.3 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an a… |