2024 CVEs (page 277)
Page 277 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28063 | Medium | 6.1 | 2024-05-18 | Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS. |
CVE-2024-36048 | Critical | 9.8 | 2024-05-18 | QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses… |
CVE-2024-5094 | High | 7.3 | 2024-05-18 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This issue affects some unknown processing of t… |
CVE-2024-36043 | Medium | 6.1 | 2024-05-18 | question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property. |
CVE-2024-5093 | High | 7.3 | 2024-05-18 | A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of… |
CVE-2024-34083 | Medium | 5.4 | 2024-05-18 | aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted comm… |
CVE-2024-31879 | High | 7.5 | 2024-05-18 | IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the de… |
CVE-2024-3745 | High | 7.8 | 2024-05-18 | MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE… |
CVE-2024-5088 | Medium | 6.4 | 2024-05-18 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including… |
CVE-2024-4432 | Medium | 6.4 | 2024-05-18 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includin… |
CVE-2024-4709 | Medium | 6.4 | 2024-05-18 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-4698 | Medium | 6.4 | 2024-05-18 | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_anim… |
CVE-2024-2782 | High | 7.5 | 2024-05-18 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of da… |
CVE-2024-2772 | Medium | 6.4 | 2024-05-18 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-2771 | Critical | 9.8 | 2024-05-18 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a m… |
CVE-2024-4849 | Medium | 6.4 | 2024-05-18 | The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and includ… |
CVE-2024-3812 | High | 7.5 | 2024-05-18 | The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_l… |
CVE-2024-3811 | Medium | 6.4 | 2024-05-18 | The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including… |
CVE-2024-3810 | High | 8.8 | 2024-05-18 | The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image'… |
CVE-2024-4891 | Medium | 6.4 | 2024-05-18 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’… |
CVE-2024-4374 | Medium | 6.4 | 2024-05-18 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2… |
CVE-2024-3714 | Medium | 6.4 | 2024-05-18 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode… |
CVE-2024-4865 | Medium | 6.4 | 2024-05-18 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including… |
CVE-2024-4264 | Critical | 9.8 | 2024-05-18 | A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` funct… |
CVE-2024-23556 | Medium | 5.9 | 2024-05-18 | SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability. |
CVE-2024-23554 | Medium | 5.7 | 2024-05-18 | Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). |
CVE-2024-23583 | Medium | 6.7 | 2024-05-17 | An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on Windows systems. |
CVE-2024-35313 | High | 7.3 | 2024-05-17 | In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004. |
CVE-2024-35312 | Medium | 6.2 | 2024-05-17 | In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. |
CVE-2024-25742 | Medium | 6.5 | 2024-05-17 | In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AM… |
CVE-2024-5069 | Medium | 6.3 | 2024-05-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0. Affected by this issue is s… |
CVE-2024-5066 | Medium | 6.3 | 2024-05-17 | A vulnerability classified as critical was found in PHPGurukul Online Course Registration System 3.1. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-5065 | High | 7.3 | 2024-05-17 | A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function of the file /onlinec… |
CVE-2024-34959 | Medium | 5.5 | 2024-05-17 | DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php. |
CVE-2024-5064 | High | 7.3 | 2024-05-17 | A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-5063 | High | 7.3 | 2024-05-17 | A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2024-5022 | Medium | 4.4 | 2024-05-17 | The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS <… |
CVE-2024-34997 | High | 7.5 | 2024-05-17 | joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is… |
CVE-2024-3292 | High | 8.2 | 2024-05-17 | A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installatio… |
CVE-2024-3291 | High | 7.8 | 2024-05-17 | When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure per… |
CVE-2024-3290 | High | 8.2 | 2024-05-17 | A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time… |
CVE-2024-3289 | High | 7.8 | 2024-05-17 | When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for… |
CVE-2024-35190 | Medium | 5.8 | 2024-05-17 | Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpo… |
CVE-2024-5072 | Medium | 6.5 | 2024-05-17 | Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT el… |
CVE-2024-34241 | Medium | 4.8 | 2024-05-17 | A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface whe… |
CVE-2024-34058 | High | 8.8 | 2024-05-17 | The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message). |
CVE-2024-31974 | Medium | 6.3 | 2024-05-17 | The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScrip… |
CVE-2024-22429 | High | 7.5 | 2024-05-17 | Dell BIOS contains an Improper Input Validation vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulner… |
CVE-2024-5051 | Medium | 6.3 | 2024-05-17 | A vulnerability has been found in SourceCodester Gas Agency Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2024-35859 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: block: fix module reference leakage from bdev_open_by_dev error path At the time bdev_may… |
CVE-2024-35858 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix memory leak when bringing down interface When bringing down the TX rings… |
CVE-2024-35857 | High | 7.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a doubl… |
CVE-2024-35856 | High | 8.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix double free of skb in coredump hci_devcd_append() would f… |
CVE-2024-35855 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update The rule act… |
CVE-2024-35854 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed wo… |
CVE-2024-35853 | Medium | 6.4 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates… |
CVE-2024-35852 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed w… |
CVE-2024-35851 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev suspend Qualcomm ROME controllers can be reg… |
CVE-2024-35850 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be regis… |
CVE-2024-35849 | High | 7.1 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following… |
CVE-2024-35848 | High | 7.0 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nv… |
CVE-2024-35847 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_d… |
CVE-2024-35846 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroup_disable=memory Christian reports a NULL de… |
CVE-2024-35845 | Critical | 9.1 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a… |
CVE-2024-35844 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix reserve_cblocks counting error when out of space When a file only nee… |
CVE-2024-35843 | High | 8.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler… |
CVE-2024-35842 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: sof-common: Add NULL check for normal_link string It's not granted that a… |
CVE-2024-35841 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls cod… |
CVE-2024-35840 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() subflow_finish_connect() u… |
CVE-2024-35839 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added… |
CVE-2024-5050 | Medium | 6.3 | 2024-05-17 | A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_s… |
CVE-2024-5049 | Medium | 6.3 | 2024-05-17 | A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2024-5048 | Medium | 6.3 | 2024-05-17 | A vulnerability classified as critical was found in code-projects Budget Management 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-5047 | High | 7.3 | 2024-05-17 | A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/con… |
CVE-2024-5042 | Medium | 6.6 | 2024-05-17 | A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a… |
CVE-2024-35838 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential sta-link leak When a station is allocated, links are added… |
CVE-2024-35837 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the… |
CVE-2024-35836 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin r… |
CVE-2024-35835 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails… |
CVE-2024-35834 | High | 8.2 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk… |
CVE-2024-35833 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA This dma_alloc_co… |
CVE-2024-35832 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit bch_fs::snapshots is allocat… |
CVE-2024-35831 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix release of pinned pages when __io_uaddr_map fails Looking at the error path… |
CVE-2024-35830 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device… |
CVE-2024-35829 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need… |
CVE-2024-35828 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lb… |
CVE-2024-35827 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is… |
CVE-2024-35826 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages() Fix an incorrect… |
CVE-2024-35825 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux h… |
CVE-2024-35824 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume When no… |
CVE-2024-35823 | Medium | 5.3 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that wa… |
CVE-2024-35822 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning mess… |
CVE-2024-35821 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting t… |
CVE-2024-35819 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlock for cgr_lock smp_call_function always runs its callback… |
CVE-2024-35818 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Define the __io_aw() hook as mmiowb() Commit fb24ea52f78e0d595852e ("drivers… |
CVE-2024-35817 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag Otherwise after the GTT bo is release… |
CVE-2024-35816 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: prevent leak of left-over IRQ on unbind Commit 5a95f1ded28691e6 ("firewir… |
CVE-2024-35815 | Medium | 5.5 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_canc… |
CVE-2024-35814 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103… |
CVE-2024-35813 | High | 7.8 | 2024-05-17 | In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index with array access Commit 4d0c8d0aef63 ("mmc: core: Use mr… |