2024 CVEs (page 252)
Page 252 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32892 | High | 7.8 | 2024-06-13 | In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no add… |
CVE-2024-32891 | High | 7.0 | 2024-06-13 | In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no addi… |
CVE-2024-29787 | High | 7.8 | 2024-06-13 | In lwis_process_transactions_in_queue of lwis_transaction.c, there is a possible use after free due to a use after free. This could lead to local escalation of… |
CVE-2024-29786 | Critical | 9.8 | 2024-06-13 | In pktproc_fill_data_addr_without_bm of link_rx_pktproc.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote cod… |
CVE-2024-29785 | Medium | 5.5 | 2024-06-13 | In aur_get_state of aurora.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no add… |
CVE-2024-29784 | High | 7.8 | 2024-06-13 | In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege… |
CVE-2024-29781 | High | 7.5 | 2024-06-13 | In ss_AnalyzeOssReturnResUssdArgIe of ss_OssAsnManagement.c, there is a possible out of bounds read due to improper input validation. This could lead to remote… |
CVE-2024-29780 | Medium | 5.5 | 2024-06-13 | In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This c… |
CVE-2024-29778 | Medium | 4.7 | 2024-06-13 | In ProtocolPsDedicatedBearInfoAdapter::processQosSession of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This c… |
CVE-2024-5952 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass auth… |
CVE-2024-5951 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypas… |
CVE-2024-5950 | High | 8.8 | 2024-06-13 | Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacen… |
CVE-2024-5949 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a… |
CVE-2024-5948 | High | 8.8 | 2024-06-13 | Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent atta… |
CVE-2024-5947 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attack… |
CVE-2024-5924 | High | 8.8 | 2024-06-13 | Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechan… |
CVE-2024-4696 | High | 7.5 | 2024-06-13 | A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed… |
CVE-2024-38313 | Medium | 4.3 | 2024-06-13 | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulne… |
CVE-2024-38312 | Medium | 6.5 | 2024-06-13 | When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after ap… |
CVE-2024-38083 | Medium | 4.3 | 2024-06-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-30058 | Medium | 5.4 | 2024-06-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-30057 | Medium | 5.4 | 2024-06-13 | Microsoft Edge for iOS Spoofing Vulnerability |
CVE-2024-37635 | Critical | 9.8 | 2024-06-13 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiBasicCfg |
CVE-2024-37634 | Critical | 9.8 | 2024-06-13 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiEasyCfg. |
CVE-2024-37633 | High | 8.8 | 2024-06-13 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiGuestCfg |
CVE-2024-37632 | Critical | 9.8 | 2024-06-13 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth . |
CVE-2024-37631 | High | 8.8 | 2024-06-13 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the File parameter in function UploadCustomModule. |
CVE-2024-36589 | Medium | 4.3 | 2024-06-13 | An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to… |
CVE-2024-36588 | Medium | 6.5 | 2024-06-13 | An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a c… |
CVE-2024-36587 | High | 7.8 | 2024-06-13 | Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscryp… |
CVE-2024-36586 | High | 8.8 | 2024-06-13 | An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary. |
CVE-2024-38285 | | 2024-06-13 | Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools. | |
CVE-2024-38284 | | 2024-06-13 | Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls. | |
CVE-2024-38283 | | 2024-06-13 | Sensitive customer information is stored in the device without encryption. | |
CVE-2024-38282 | | 2024-06-13 | Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the operations or shutdown… | |
CVE-2024-37630 | High | 8.8 | 2024-06-13 | D-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as root. |
CVE-2024-37029 | High | 7.8 | 2024-06-13 | Fuji Electric Tellus Lite V-Simulator is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. |
CVE-2024-37022 | High | 7.8 | 2024-06-13 | Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of a… |
CVE-2024-36760 | High | 7.5 | 2024-06-13 | A stack overflow vulnerability was found in version 1.18.0 of rhai. The flaw position is: (/ SRC/rhai/SRC/eval/STMT. Rs in rhai: : eval: : STMT: : _ $LT $impl… |
CVE-2024-38281 | Critical | 9.8 | 2024-06-13 | An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device. |
CVE-2024-38280 | Medium | 4.6 | 2024-06-13 | An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stor… |
CVE-2024-38279 | Medium | 4.6 | 2024-06-13 | The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file syste… |
CVE-2024-37280 | Medium | 4.9 | 2024-06-13 | A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certa… |
CVE-2024-37279 | Medium | 4.3 | 2024-06-13 | A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting… |
CVE-2024-32504 | High | 8.4 | 2024-06-13 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos… |
CVE-2024-31956 | High | 8.4 | 2024-06-13 | An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. It lacks proper buffer length checking, which can result in an Out-o… |
CVE-2024-37877 | Medium | 5.5 | 2024-06-13 | UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length. This occurs in function readOctetString in src/u… |
CVE-2024-37307 | High | 7.9 | 2024-06-13 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, an… |
CVE-2024-29169 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker cou… |
CVE-2024-22441 | Critical | 9.8 | 2024-06-13 | HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. |
CVE-2024-37306 | High | 7.1 | 2024-06-13 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2… |
CVE-2024-37164 | High | 7.1 | 2024-06-13 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs… |
CVE-2024-37131 | High | 7.5 | 2024-06-13 | SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could pote… |
CVE-2024-29168 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker co… |
CVE-2024-28969 | Medium | 4.3 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28968 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST API… |
CVE-2024-28967 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by… |
CVE-2024-28966 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admi… |
CVE-2024-28965 | Medium | 5.4 | 2024-06-13 | Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by Admi… |
CVE-2024-37849 | Critical | 9.8 | 2024-06-13 | A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in process.php via the username parameter. |
CVE-2024-37309 | Medium | 5.3 | 2024-06-13 | CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port 4200) permits clie… |
CVE-2024-37308 | Medium | 5.4 | 2024-06-13 | The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions… |
CVE-2024-36647 | Medium | 5.4 | 2024-06-13 | A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2024-25052 | Medium | 4.4 | 2024-06-13 | IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363. |
CVE-2024-22333 | Low | 3.3 | 2024-06-13 | IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on t… |
CVE-2024-36396 | High | 8.8 | 2024-06-13 | Verint - CWE-434: Unrestricted Upload of File with Dangerous Type |
CVE-2024-36395 | Medium | 6.1 | 2024-06-13 | Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-32860 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-32859 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-32858 | High | 7.5 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-34130 | Medium | 5.5 | 2024-06-13 | Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature… |
CVE-2024-34129 | High | 7.5 | 2024-06-13 | Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… |
CVE-2024-34116 | High | 7.1 | 2024-06-13 | Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature… |
CVE-2024-34115 | High | 7.8 | 2024-06-13 | Substance3D - Stager versions 2.1.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2024-34113 | Medium | 5.5 | 2024-06-13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass… |
CVE-2024-34112 | High | 7.5 | 2024-06-13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2024-32856 | Medium | 5.1 | 2024-06-13 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-30472 | High | 7.5 | 2024-06-13 | Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the d… |
CVE-2024-30300 | Critical | 9.8 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privi… |
CVE-2024-30299 | Critical | 10.0 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-20753 | High | 7.8 | 2024-06-13 | Photoshop Desktop versions 24.7.3, 25.7 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a re… |
CVE-2024-30278 | Medium | 5.5 | 2024-06-13 | Media Encoder versions 23.6.5, 24.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-4371 | Critical | 9.0 | 2024-06-13 | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection… |
CVE-2024-4176 | Medium | 4.1 | 2024-06-13 | An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command l… |
CVE-2024-3073 | Low | 2.7 | 2024-06-13 | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and inclu… |
CVE-2024-34111 | Medium | 6.5 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a… |
CVE-2024-34110 | High | 7.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that c… |
CVE-2024-34109 | High | 7.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitra… |
CVE-2024-34108 | Critical | 9.1 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitra… |
CVE-2024-34107 | Medium | 5.3 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Securit… |
CVE-2024-34106 | Medium | 5.3 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a securit… |
CVE-2024-34105 | Medium | 4.8 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused… |
CVE-2024-34104 | High | 8.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security… |
CVE-2024-34103 | High | 8.1 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-34102 | Critical | 9.8 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulner… |
CVE-2024-30285 | Medium | 5.5 | 2024-06-13 | Audition versions 24.2, 23.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service condi… |
CVE-2024-30276 | Medium | 5.5 | 2024-06-13 | Audition versions 24.2, 23.6.4 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An at… |
CVE-2024-1565 | Medium | 6.4 | 2024-06-13 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2024-0979 | Medium | 6.1 | 2024-06-13 | The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including… |
CVE-2024-4615 | Medium | 6.4 | 2024-06-13 | The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required… |