2024 CVEs (page 243)
Page 243 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39276 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() Syzbot reports… |
CVE-2024-38661 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: s390/ap: Fix crash in AP internal function modify_bitmap() A system crash like this Fa… |
CVE-2024-38385 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() irq_find_at_or_after() d… |
CVE-2024-38306 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: protect folio::private when attaching extent buffer folios [BUG] Since v6.8 there… |
CVE-2024-37354 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seei… |
CVE-2024-37087 | Medium | 5.3 | 2024-06-25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. |
CVE-2024-37086 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapsh… |
CVE-2024-37085 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX… |
CVE-2024-37078 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes… |
CVE-2024-5451 | Medium | 6.4 | 2024-06-25 | The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plug… |
CVE-2024-38952 | High | 7.5 | 2024-06-25 | PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp. |
CVE-2024-38951 | Medium | 6.5 | 2024-06-25 | A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message. |
CVE-2024-32111 | Medium | 5.0 | 2024-06-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue… |
CVE-2024-21827 | High | 7.2 | 2024-06-25 | A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A s… |
CVE-2024-6303 | Critical | 9.9 | 2024-06-25 | Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege… |
CVE-2024-6302 | High | 8.1 | 2024-06-25 | Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same… |
CVE-2024-6301 | Medium | 5.3 | 2024-06-25 | Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |
CVE-2024-6299 | Medium | 4.8 | 2024-06-25 | Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the r… |
CVE-2024-5261 | Critical | 9.8 | 2024-06-25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for acce… |
CVE-2024-4846 | Medium | 6.3 | 2024-06-25 | Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without… |
CVE-2024-31111 | Medium | 6.5 | 2024-06-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue… |
CVE-2024-28832 | Medium | 4.8 | 2024-06-25 | Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Setti… |
CVE-2024-28831 | Medium | 5.4 | 2024-06-25 | Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML ele… |
CVE-2024-6307 | Medium | 6.4 | 2024-06-25 | WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outp… |
CVE-2024-5216 | High | 7.5 | 2024-06-25 | A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue… |
CVE-2024-4641 | Medium | 6.3 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an a… |
CVE-2024-4640 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker… |
CVE-2024-4639 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An a… |
CVE-2024-6028 | Critical | 9.8 | 2024-06-25 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 d… |
CVE-2024-4638 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload functi… |
CVE-2024-34142 | Medium | 5.4 | 2024-06-25 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-34141 | Medium | 5.4 | 2024-06-25 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-3249 | Medium | 4.3 | 2024-06-25 | The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_dat… |
CVE-2024-5431 | High | 8.8 | 2024-06-25 | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-4759 | Medium | 5.5 | 2024-06-25 | The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a ma… |
CVE-2024-4757 | High | 8.1 | 2024-06-25 | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul… |
CVE-2024-6297 | Critical | 10.0 | 2024-06-25 | Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the s… |
CVE-2024-4197 | Critical | 9.9 | 2024-06-25 | An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected… |
CVE-2024-4196 | Critical | 10.0 | 2024-06-25 | An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web req… |
CVE-2024-37007 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability… |
CVE-2024-37006 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access v… |
CVE-2024-37005 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this… |
CVE-2024-37004 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability… |
CVE-2024-37003 | High | 7.8 | 2024-06-25 | A maliciously crafted DWG and SLDPRT file, when parsed in opennurbs.dll and ODXSW_DLL.dll through Autodesk applications, can be used to cause a Stack-based Ove… |
CVE-2024-36999 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Write. A malicious actor can leverage th… |
CVE-2024-32855 | Low | 3.8 | 2024-06-25 | Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access coul… |
CVE-2024-23159 | High | 7.8 | 2024-06-25 | A maliciously crafted STP file, when parsed in stp_aim_x64_vc15d.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability… |
CVE-2024-23158 | High | 7.8 | 2024-06-25 | A maliciously crafted IGES file, when parsed in ASMImport229A.dll through Autodesk applications, can be used to cause a use-after-free vulnerability. A malicio… |
CVE-2024-23157 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can lead to a memory corruption vulnerability by write… |
CVE-2024-23156 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll and ASMkern229A.dll through Autodesk applications, can lead to a memory corruption vulnerability b… |
CVE-2024-23155 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in atf_asm_interface.dll through Autodesk applications, can be used to cause a Heap-based Buffer Overflow. A mali… |
CVE-2024-23154 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor ca… |
CVE-2024-23153 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in libodx.dll through Autodesk applications, can force an Out-of-Bounds Read. A malicious actor can leverage this… |
CVE-2024-23152 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Read. A malicious actor can leverage thi… |
CVE-2024-23151 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in ASMkern229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-23150 | High | 7.8 | 2024-06-25 | A maliciously crafted PRT file, when parsed in odxug_dll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may le… |
CVE-2024-6295 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical… |
CVE-2024-37002 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, alon… |
CVE-2024-37001 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can l… |
CVE-2024-37000 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by write access violat… |
CVE-2024-23149 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDDRW file, when parsed in ODXSW_DLL.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage t… |
CVE-2024-23148 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access v… |
CVE-2024-23147 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART, X_B and STEP, when parsed in ASMKERN228A.dll and ASMKERN229A.dll through Autodesk applications, can lead to a memory corruption… |
CVE-2024-23146 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicio… |
CVE-2024-23145 | High | 7.8 | 2024-06-25 | A maliciously crafted PRT file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this… |
CVE-2024-6294 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android devi… |
CVE-2024-23144 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A m… |
CVE-2024-23143 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM, MODEL and X_B file, when parsed in ASMkern229A.dll and ASMBASE229A.dll through Autodesk applications, can force an Out-of-Bound Read… |
CVE-2024-23142 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cau… |
CVE-2024-23141 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in libodxdll through Autodesk applications, can cause a double free. This vulnerability, along with other vulnera… |
CVE-2024-23140 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM and MODEL file, when parsed in opennurbs.dll and atf_api.dll through Autodesk applications, can force an Out-of-Bound Read. A malicio… |
CVE-2024-22385 | Medium | 4.4 | 2024-06-25 | Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affec… |
CVE-2024-36683 | High | 7.3 | 2024-06-24 | SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive… |
CVE-2024-36681 | Critical | 9.8 | 2024-06-24 | SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and c… |
CVE-2024-34992 | High | 8.8 | 2024-06-24 | SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allow… |
CVE-2024-34988 | Critical | 9.8 | 2024-06-24 | SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop… |
CVE-2024-22168 | | 2024-06-24 | A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redire… | |
CVE-2024-6293 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6292 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6291 | High | 8.8 | 2024-06-24 | Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-6290 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-36682 | High | 7.5 | 2024-06-24 | In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenan… |
CVE-2024-34991 | High | 7.5 | 2024-06-24 | In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / post… |
CVE-2024-33898 | Critical | 9.8 | 2024-06-24 | Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote atta… |
CVE-2024-38903 | Medium | 4.1 | 2024-06-24 | H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. |
CVE-2024-38902 | Critical | 9.8 | 2024-06-24 | H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-38897 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38896 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. |
CVE-2024-38895 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38894 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. |
CVE-2024-38892 | Medium | 6.5 | 2024-06-24 | An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component. |
CVE-2024-37759 | Critical | 9.8 | 2024-06-24 | DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface. |
CVE-2024-37681 | Medium | 6.5 | 2024-06-24 | An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via t… |
CVE-2024-37678 | Medium | 5.3 | 2024-06-24 | Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary… |
CVE-2024-34313 | Critical | 9.8 | 2024-06-24 | An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. |
CVE-2024-34312 | Medium | 6.1 | 2024-06-24 | Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. |
CVE-2024-37732 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. |
CVE-2024-37680 | Medium | 6.1 | 2024-06-24 | Hangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to execute arbitrary c… |
CVE-2024-37679 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary… |