2024 CVEs (page 258)
Page 258 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27855 | High | 8.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, macOS Ventura 1… |
CVE-2024-27851 | High | 8.8 | 2024-06-10 | The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2… |
CVE-2024-27850 | Medium | 6.5 | 2024-06-10 | This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, v… |
CVE-2024-27848 | High | 7.8 | 2024-06-10 | This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to… |
CVE-2024-27845 | Low | 3.3 | 2024-06-10 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.5 and iPadOS 17.5. An app may be able to access Notes at… |
CVE-2024-27844 | Medium | 5.5 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A website's permission dialog may persist af… |
CVE-2024-27840 | Medium | 6.3 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
CVE-2024-27838 | Medium | 6.5 | 2024-06-10 | The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14… |
CVE-2024-27836 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visionOS 1.2. Processing a maliciously crafte… |
CVE-2024-27833 | High | 8.8 | 2024-06-10 | An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, t… |
CVE-2024-27832 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |
CVE-2024-27831 | High | 7.8 | 2024-06-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS… |
CVE-2024-27830 | Medium | 6.5 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionO… |
CVE-2024-27828 | High | 7.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be ab… |
CVE-2024-27820 | High | 8.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma… |
CVE-2024-27819 | Low | 2.4 | 2024-06-10 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access ma… |
CVE-2024-27817 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonom… |
CVE-2024-27815 | High | 7.8 | 2024-06-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visio… |
CVE-2024-27814 | Low | 2.4 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view… |
CVE-2024-27812 | Medium | 6.5 | 2024-06-10 | A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content may lead to a denial-of-service. |
CVE-2024-27811 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |
CVE-2024-27808 | High | 8.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2… |
CVE-2024-27807 | Medium | 4.3 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5. An app may be able to circumvent A… |
CVE-2024-27806 | Medium | 5.5 | 2024-06-10 | This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey… |
CVE-2024-27805 | Medium | 5.5 | 2024-06-10 | An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS… |
CVE-2024-27802 | High | 7.8 | 2024-06-10 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monter… |
CVE-2024-27801 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |
CVE-2024-27800 | Medium | 6.5 | 2024-06-10 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5… |
CVE-2024-27799 | Low | 3.3 | 2024-06-10 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.5, mac… |
CVE-2024-23282 | Medium | 5.5 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A… |
CVE-2024-23251 | Medium | 4.6 | 2024-06-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sono… |
CVE-2024-37393 | High | 7.5 | 2024-06-10 | Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote at… |
CVE-2024-37014 | Critical | 9.8 | 2024-06-10 | Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python scr… |
CVE-2024-36417 | Medium | 5.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added s… |
CVE-2024-36416 | High | 8.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no… |
CVE-2024-36415 | Critical | 9.1 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file ve… |
CVE-2024-36414 | High | 7.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors f… |
CVE-2024-36413 | High | 8.9 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import modul… |
CVE-2024-36412 | Critical | 10.0 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response… |
CVE-2024-36411 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-32167 | Critical | 9.1 | 2024-06-10 | Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting… |
CVE-2024-27792 | Medium | 5.5 | 2024-06-10 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive… |
CVE-2024-23299 | High | 8.6 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to brea… |
CVE-2024-22279 | Medium | 5.9 | 2024-06-10 | Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Clou… |
CVE-2024-36410 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36409 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-31612 | Medium | 6.5 | 2024-06-10 | Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information. |
CVE-2024-5597 | High | 7.8 | 2024-06-10 | Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. |
CVE-2024-5102 | High | 7.0 | 2024-06-10 | A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run pro… |
CVE-2024-3850 | Medium | 5.4 | 2024-06-10 | Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malic… |
CVE-2024-36408 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36407 | Low | 3.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset fro… |
CVE-2024-35754 | High | 7.5 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affect… |
CVE-2024-35749 | Low | 3.7 | 2024-06-10 | Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Und… |
CVE-2024-35747 | Medium | 5.3 | 2024-06-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue… |
CVE-2024-35746 | Critical | 10.0 | 2024-06-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: f… |
CVE-2024-35745 | High | 7.5 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations allow… |
CVE-2024-35744 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Mani… |
CVE-2024-35743 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulati… |
CVE-2024-35728 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Themeisle PPOM for WooCommerce allows Code… |
CVE-2024-31611 | Critical | 9.1 | 2024-06-10 | SeaCMS 12.9 has a file deletion vulnerability via admin_template.php. |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2024-35712 | Medium | 4.9 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This… |
CVE-2024-35680 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-produ… |
CVE-2024-35677 | Critical | 9.0 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This is… |
CVE-2024-35658 | High | 8.6 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Fu… |
CVE-2024-35650 | Medium | 4.9 | 2024-06-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security mel… |
CVE-2024-35474 | Medium | 6.5 | 2024-06-10 | A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in Res… |
CVE-2024-34800 | High | 7.6 | 2024-06-10 | Missing Authorization vulnerability in Crafthemes Crafthemes Demo Import crafthemes-demo-import allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2024-34762 | Critical | 9.9 | 2024-06-10 | Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability i… |
CVE-2024-34761 | High | 8.5 | 2024-06-10 | Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanc… |
CVE-2024-34332 | High | 7.8 | 2024-06-10 | An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent to the Kernel Driver… |
CVE-2024-31613 | Medium | 5.4 | 2024-06-10 | BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code." |
CVE-2024-26507 | High | 7.8 | 2024-06-10 | An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate privileg… |
CVE-2024-4403 | High | 8.8 | 2024-06-10 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers… |
CVE-2024-36972 | High | 7.8 | 2024-06-10 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong… |
CVE-2024-36531 | Medium | 5.7 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component. |
CVE-2024-36528 | High | 8.8 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/down… |
CVE-2024-36406 | Medium | 5.4 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open… |
CVE-2024-35307 | Critical | 9.8 | 2024-06-10 | Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. Th… |
CVE-2024-35306 | Critical | 9.8 | 2024-06-10 | OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 th… |
CVE-2024-35305 | Critical | 9.8 | 2024-06-10 | Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777. |
CVE-2024-35304 | Critical | 9.8 | 2024-06-10 | System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects… |
CVE-2024-5786 | Medium | 6.5 | 2024-06-10 | Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to fo… |
CVE-2024-5785 | High | 8.0 | 2024-06-10 | Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user… |
CVE-2024-36405 | Medium | 5.9 | 2024-06-10 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identif… |
CVE-2024-3700 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all S… |
CVE-2024-3699 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all d… |
CVE-2024-28833 | Medium | 5.9 | 2024-06-10 | Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of sec… |
CVE-2024-1228 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all E… |
CVE-2024-36971 | High | 7.8 | 2024-06-10 | In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU… |
CVE-2024-4746 | Medium | 4.3 | 2024-06-10 | Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm… |
CVE-2024-4745 | Medium | 4.3 | 2024-06-10 | Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a thr… |
CVE-2024-4744 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in Avirtum iPages Flipbook.This issue affects iPages Flipbook: from n/a through 1.5.1. |
CVE-2024-4328 | High | 8.1 | 2024-06-10 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability aris… |
CVE-2024-35742 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0. |
CVE-2024-35741 | Medium | 4.3 | 2024-06-10 | Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7. |
CVE-2024-35735 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11. |
CVE-2024-35729 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-35727 | Medium | 4.3 | 2024-06-10 | Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through… |