2024 CVEs (page 245)
Page 245 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35760 | Medium | 5.9 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows DOM-Based… |
CVE-2024-35759 | Medium | 5.9 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affect… |
CVE-2024-35758 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Horse Interface allows Stored XSS.This issue… |
CVE-2024-35757 | Medium | 5.9 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.T… |
CVE-2024-5058 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows Stored XSS.This iss… |
CVE-2024-39277 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: handle NUMA_NO_NODE correctly cpumask_of_node() can be called for… |
CVE-2024-38780 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-b… |
CVE-2024-38662 | Medium | 4.7 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx… |
CVE-2024-36481 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might retur… |
CVE-2024-36477 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer The TPM SPI trans… |
CVE-2024-36288 | Critical | 9.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[]… |
CVE-2024-35779 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer all… |
CVE-2024-35774 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in D’arteweb DImage 360 allows Stored XSS.This issue… |
CVE-2024-35769 | Medium | 5.9 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in John West Slideshow SE allows Stored XSS.This issu… |
CVE-2024-34777 | High | 7.1 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: fix node id validation While validating node ids in map_benchmark… |
CVE-2024-3036 | Medium | 5.7 | 2024-06-21 | Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending… |
CVE-2024-38659 | High | 7.3 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that… |
CVE-2024-38637 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of get_channel_from_mode If channel for the given node is n… |
CVE-2024-38636 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: f2fs: multidev: fix to recognize valid zero block address As reported by Yi Zhang in mail… |
CVE-2024-38635 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI… |
CVE-2024-38634 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port->lock when calling uart_handle_cts_change() uart_handle_cts_ch… |
CVE-2024-38633 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uart_driver_registered on driver removal The removal of the last… |
CVE-2024-38632 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() If vfio_irq_ctx_alloc() failed… |
CVE-2024-38631 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: PAC1934: fix accessing out of bounds array index Fix accessing out of bounds ar… |
CVE-2024-38630 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt mo… |
CVE-2024-38629 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during c… |
CVE-2024-38628 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. … |
CVE-2024-38627 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will… |
CVE-2024-38626 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was r… |
CVE-2024-38625 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called. |
CVE-2024-38624 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: v… |
CVE-2024-38623 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntf… |
CVE-2024-38622 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback… |
CVE-2024-38621 | High | 7.1 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtract in this conditio… |
CVE-2024-38390 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Calling a6xx_destro… |
CVE-2024-38388 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup Use the control private_free c… |
CVE-2024-38381 | High | 8.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value acce… |
CVE-2024-37356 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_alpha(), we use a m… |
CVE-2024-36489 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is miss… |
CVE-2024-36484 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WA… |
CVE-2024-36478 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Writing… |
CVE-2024-36286 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() syzbot repo… |
CVE-2024-36281 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules rx_create no… |
CVE-2024-36270 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general… |
CVE-2024-36244 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible… |
CVE-2024-33621 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET sock… |
CVE-2024-33619 | High | 7.8 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: efi: libstub: only free priv.runtime_map when allocated priv.runtime_map is only allocate… |
CVE-2024-31076 | Medium | 5.5 | 2024-06-21 | In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD… |
CVE-2024-6027 | Critical | 9.8 | 2024-06-21 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, a… |
CVE-2024-31890 | High | 7.8 | 2024-06-21 | IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command lin… |
CVE-2024-5859 | Medium | 6.1 | 2024-06-21 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in a… |
CVE-2024-6225 | Medium | 4.4 | 2024-06-21 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions… |
CVE-2024-5945 | Medium | 6.4 | 2024-06-21 | The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to i… |
CVE-2024-2003 | High | 7.3 | 2024-06-21 | Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from quarantine. |
CVE-2024-5639 | Medium | 4.3 | 2024-06-21 | The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_c… |
CVE-2024-5191 | Medium | 6.4 | 2024-06-21 | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ paramet… |
CVE-2024-38874 | Medium | 5.4 | 2024-06-21 | An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lea… |
CVE-2024-38873 | Medium | 5.3 | 2024-06-21 | An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check th… |
CVE-2024-5448 | Medium | 5.4 | 2024-06-21 | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes bef… |
CVE-2024-5447 | Medium | 4.8 | 2024-06-21 | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could al… |
CVE-2024-4970 | Medium | 4.8 | 2024-06-21 | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-4969 | Medium | 4.3 | 2024-06-21 | The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/dis… |
CVE-2024-4755 | Medium | 4.8 | 2024-06-21 | The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-4616 | Medium | 6.1 | 2024-06-21 | The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-4477 | Medium | 5.4 | 2024-06-21 | The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to… |
CVE-2024-4475 | Medium | 4.3 | 2024-06-21 | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the lo… |
CVE-2024-4474 | Medium | 4.3 | 2024-06-21 | The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2024-4384 | Medium | 4.8 | 2024-06-21 | The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-4382 | Medium | 6.5 | 2024-06-21 | The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-4381 | Medium | 4.8 | 2024-06-21 | The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-4377 | Medium | 5.4 | 2024-06-21 | The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2024-5756 | Critical | 9.8 | 2024-06-21 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-5455 | High | 8.8 | 2024-06-21 | The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'maga… |
CVE-2024-3961 | Medium | 5.3 | 2024-06-21 | The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due t… |
CVE-2024-6218 | High | 7.3 | 2024-06-21 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-6217 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-6216 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file add-us… |
CVE-2024-6215 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been rated as critical. This issue affects some unknown processin… |
CVE-2024-5503 | High | 8.8 | 2024-06-21 | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for aut… |
CVE-2024-5344 | Medium | 6.1 | 2024-06-21 | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the pl… |
CVE-2024-3610 | Medium | 5.3 | 2024-06-21 | The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_t… |
CVE-2024-1955 | Medium | 4.3 | 2024-06-21 | The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_noti… |
CVE-2024-1639 | Medium | 6.5 | 2024-06-21 | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey()… |
CVE-2024-6214 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2024-6213 | High | 7.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-6212 | Low | 3.5 | 2024-06-21 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. Affected by this issue is the function get_stud… |
CVE-2024-38361 | Low | 3.7 | 2024-06-20 | Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion un… |
CVE-2024-38359 | Medium | 6.5 | 2024-06-20 | The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead… |
CVE-2024-37899 | Critical | 9.0 | 2024-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's prof… |
CVE-2024-35246 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. |
CVE-2024-32943 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly. |
CVE-2024-5746 | High | 7.6 | 2024-06-20 | A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitr… |
CVE-2024-37183 | Medium | 5.7 | 2024-06-20 | Plain text credentials and session ID can be captured with a network sniffer. |
CVE-2024-36071 | Medium | 6.3 | 2024-06-20 | Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. Th… |
CVE-2024-31586 | Medium | 6.1 | 2024-06-20 | A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute… |
CVE-2024-30848 | Medium | 6.1 | 2024-06-20 | Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the ve… |
CVE-2024-29390 | High | 7.3 | 2024-06-20 | Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page… |
CVE-2024-6154 | Medium | 6.7 | 2024-06-20 | Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2024-6153 | High | 7.8 | 2024-06-20 | Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels softw… |
CVE-2024-6147 | High | 7.8 | 2024-06-20 | Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected inst… |