2024 CVEs (page 243)
Page 243 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4640 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker… |
CVE-2024-4639 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An a… |
CVE-2024-6028 | Critical | 9.8 | 2024-06-25 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 d… |
CVE-2024-4638 | High | 7.1 | 2024-06-25 | OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload functi… |
CVE-2024-34142 | Medium | 5.4 | 2024-06-25 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-34141 | Medium | 5.4 | 2024-06-25 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-3249 | Medium | 4.3 | 2024-06-25 | The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_dat… |
CVE-2024-5431 | High | 8.8 | 2024-06-25 | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-4759 | Medium | 5.5 | 2024-06-25 | The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a ma… |
CVE-2024-4757 | High | 8.1 | 2024-06-25 | The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which coul… |
CVE-2024-6297 | Critical | 10.0 | 2024-06-25 | Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the s… |
CVE-2024-4197 | Critical | 9.9 | 2024-06-25 | An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected… |
CVE-2024-4196 | Critical | 10.0 | 2024-06-25 | An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web req… |
CVE-2024-37007 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability… |
CVE-2024-37006 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access v… |
CVE-2024-37005 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this… |
CVE-2024-37004 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability… |
CVE-2024-37003 | High | 7.8 | 2024-06-25 | A maliciously crafted DWG and SLDPRT file, when parsed in opennurbs.dll and ODXSW_DLL.dll through Autodesk applications, can be used to cause a Stack-based Ove… |
CVE-2024-36999 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Write. A malicious actor can leverage th… |
CVE-2024-32855 | Low | 3.8 | 2024-06-25 | Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access coul… |
CVE-2024-23159 | High | 7.8 | 2024-06-25 | A maliciously crafted STP file, when parsed in stp_aim_x64_vc15d.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability… |
CVE-2024-23158 | High | 7.8 | 2024-06-25 | A maliciously crafted IGES file, when parsed in ASMImport229A.dll through Autodesk applications, can be used to cause a use-after-free vulnerability. A malicio… |
CVE-2024-23157 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can lead to a memory corruption vulnerability by write… |
CVE-2024-23156 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll and ASMkern229A.dll through Autodesk applications, can lead to a memory corruption vulnerability b… |
CVE-2024-23155 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in atf_asm_interface.dll through Autodesk applications, can be used to cause a Heap-based Buffer Overflow. A mali… |
CVE-2024-23154 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor ca… |
CVE-2024-23153 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in libodx.dll through Autodesk applications, can force an Out-of-Bounds Read. A malicious actor can leverage this… |
CVE-2024-23152 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Read. A malicious actor can leverage thi… |
CVE-2024-23151 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in ASMkern229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-23150 | High | 7.8 | 2024-06-25 | A maliciously crafted PRT file, when parsed in odxug_dll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may le… |
CVE-2024-6295 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical… |
CVE-2024-37002 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, alon… |
CVE-2024-37001 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can l… |
CVE-2024-37000 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by write access violat… |
CVE-2024-23149 | High | 7.8 | 2024-06-25 | A maliciously crafted SLDDRW file, when parsed in ODXSW_DLL.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage t… |
CVE-2024-23148 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access v… |
CVE-2024-23147 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART, X_B and STEP, when parsed in ASMKERN228A.dll and ASMKERN229A.dll through Autodesk applications, can lead to a memory corruption… |
CVE-2024-23146 | High | 7.8 | 2024-06-25 | A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicio… |
CVE-2024-23145 | High | 7.8 | 2024-06-25 | A maliciously crafted PRT file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this… |
CVE-2024-6294 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android devi… |
CVE-2024-23144 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A m… |
CVE-2024-23143 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM, MODEL and X_B file, when parsed in ASMkern229A.dll and ASMBASE229A.dll through Autodesk applications, can force an Out-of-Bound Read… |
CVE-2024-23142 | High | 7.8 | 2024-06-25 | A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cau… |
CVE-2024-23141 | High | 7.8 | 2024-06-25 | A maliciously crafted MODEL file, when parsed in libodxdll through Autodesk applications, can cause a double free. This vulnerability, along with other vulnera… |
CVE-2024-23140 | High | 7.8 | 2024-06-25 | A maliciously crafted 3DM and MODEL file, when parsed in opennurbs.dll and atf_api.dll through Autodesk applications, can force an Out-of-Bound Read. A malicio… |
CVE-2024-22385 | Medium | 4.4 | 2024-06-25 | Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affec… |
CVE-2024-36683 | High | 7.3 | 2024-06-24 | SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive… |
CVE-2024-36681 | Critical | 9.8 | 2024-06-24 | SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and c… |
CVE-2024-34992 | High | 8.8 | 2024-06-24 | SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allow… |
CVE-2024-34988 | Critical | 9.8 | 2024-06-24 | SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop… |
CVE-2024-22168 | | 2024-06-24 | A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redire… | |
CVE-2024-6293 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6292 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6291 | High | 8.8 | 2024-06-24 | Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-6290 | High | 8.8 | 2024-06-24 | Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-36682 | High | 7.5 | 2024-06-24 | In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenan… |
CVE-2024-34991 | High | 7.5 | 2024-06-24 | In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / post… |
CVE-2024-33898 | Critical | 9.8 | 2024-06-24 | Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote atta… |
CVE-2024-38903 | Medium | 4.1 | 2024-06-24 | H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. |
CVE-2024-38902 | Critical | 9.8 | 2024-06-24 | H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-38897 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38896 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. |
CVE-2024-38895 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38894 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. |
CVE-2024-38892 | Medium | 6.5 | 2024-06-24 | An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component. |
CVE-2024-37759 | Critical | 9.8 | 2024-06-24 | DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface. |
CVE-2024-37681 | Medium | 6.5 | 2024-06-24 | An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via t… |
CVE-2024-37678 | Medium | 5.3 | 2024-06-24 | Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary… |
CVE-2024-34313 | Critical | 9.8 | 2024-06-24 | An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. |
CVE-2024-34312 | Medium | 6.1 | 2024-06-24 | Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. |
CVE-2024-37732 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. |
CVE-2024-37680 | Medium | 6.1 | 2024-06-24 | Hangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to execute arbitrary c… |
CVE-2024-37679 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary… |
CVE-2024-37677 | High | 7.5 | 2024-06-24 | An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information. |
CVE-2024-6104 | Medium | 6.0 | 2024-06-24 | go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth… |
CVE-2024-38373 | Critical | 9.6 | 2024-06-24 | FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Respon… |
CVE-2024-38369 | Critical | 9.9 | 2024-06-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include re… |
CVE-2024-33881 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-33880 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/A… |
CVE-2024-33879 | Critical | 9.8 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-6287 | High | 7.5 | 2024-06-24 | Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a… |
CVE-2024-6285 | High | 7.5 | 2024-06-24 | Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypa… |
CVE-2024-33687 | High | 7.5 | 2024-06-24 | Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the af… |
CVE-2024-4748 | High | 8.8 | 2024-06-24 | The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited si… |
CVE-2024-39292 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is r… |
CVE-2024-39291 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()… |
CVE-2024-38667 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: riscv: prevent pt_regs corruption for secondary idle threads Top of the kernel thread sta… |
CVE-2024-38664 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dpsub: Always register bridge We must always register the DRM bridge, since z… |
CVE-2024-38663 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cg… |
CVE-2024-38384 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can… |
CVE-2024-37825 | Medium | 5.4 | 2024-06-24 | An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers o… |
CVE-2024-37026 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Only use reserved BCS instances for usm migrate exec queue The GuC context schedu… |
CVE-2024-37021 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: manager: add owner module and take its refcount The current implementation of the f… |
CVE-2024-36479 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current implementation of the fp… |
CVE-2024-35247 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fp… |
CVE-2024-34030 | Medium | 4.7 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Return error for int_map allocation failure Return -ENOMEM from of_pci_… |
CVE-2024-34027 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It need… |
CVE-2024-33847 | High | 7.1 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: don't allow unaligned truncation on released compress inode f2fs image ma… |
CVE-2024-33278 | Critical | 9.8 | 2024-06-24 | Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the conn… |
CVE-2024-32936 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to D… |