2024 CVEs (page 291)
Page 291 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1930 | Medium | 6.5 | 2024-05-08 | No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Lim… |
CVE-2024-1929 | High | 7.5 | 2024-05-08 | Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configu… |
CVE-2024-4456 | Medium | 4.1 | 2024-05-08 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. |
CVE-2024-23551 | Medium | 6.5 | 2024-05-07 | Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a… |
CVE-2024-4030 | High | 7.1 | 2024-05-07 | On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other… |
CVE-2024-34346 | High | 8.4 | 2024-05-07 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write acces… |
CVE-2024-27273 | High | 8.1 | 2024-05-07 | IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram so… |
CVE-2024-23713 | High | 7.8 | 2024-05-07 | In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation… |
CVE-2024-23712 | Medium | 5.5 | 2024-05-07 | In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion. Th… |
CVE-2024-23710 | High | 7.8 | 2024-05-07 | In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a log… |
CVE-2024-23709 | Medium | 6.5 | 2024-05-07 | In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no addition… |
CVE-2024-23708 | High | 7.8 | 2024-05-07 | In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This… |
CVE-2024-23707 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2024-23706 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privil… |
CVE-2024-23705 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalatio… |
CVE-2024-23704 | High | 7.8 | 2024-05-07 | In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This coul… |
CVE-2024-0043 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead… |
CVE-2024-0042 | High | 7.8 | 2024-05-07 | In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protecti… |
CVE-2024-0027 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. This could lead to local denial of service… |
CVE-2024-0026 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-0025 | High | 7.8 | 2024-05-07 | In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of… |
CVE-2024-0024 | High | 7.8 | 2024-05-07 | In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This coul… |
CVE-2024-0022 | Medium | 5.5 | 2024-05-07 | In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to i… |
CVE-2024-4559 | Medium | 6.5 | 2024-05-07 | Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2024-4558 | Critical | 9.6 | 2024-05-07 | Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-34315 | High | 7.5 | 2024-05-07 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/templa… |
CVE-2024-34314 | Medium | 4.9 | 2024-05-07 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template… |
CVE-2024-25514 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx. |
CVE-2024-25513 | High | 7.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx. |
CVE-2024-25511 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx. |
CVE-2024-25510 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx. |
CVE-2024-25509 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx. |
CVE-2024-34517 | Medium | 6.5 | 2024-05-07 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. |
CVE-2024-34397 | Medium | 5.2 | 2024-05-07 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system… |
CVE-2024-25512 | High | 8.1 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx. |
CVE-2024-25508 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx. |
CVE-2024-25507 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx. |
CVE-2024-33860 | Medium | 6.5 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. Th… |
CVE-2024-33859 | Medium | 6.1 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. |
CVE-2024-33164 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
CVE-2024-33161 | Medium | 5.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
CVE-2024-33155 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
CVE-2024-33153 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
CVE-2024-33149 | High | 8.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
CVE-2024-33148 | High | 7.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
CVE-2024-33147 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
CVE-2024-29210 | Low | 2.8 | 2024-05-07 | A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configuration management… |
CVE-2024-29209 | Medium | 6.0 | 2024-05-07 | A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attacker to remotely ex… |
CVE-2024-29208 | Low | 2.2 | 2024-05-07 | An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. … |
CVE-2024-29207 | High | 7.5 | 2024-05-07 | An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: Uni… |
CVE-2024-29206 | Low | 2.2 | 2024-05-07 | An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the syst… |
CVE-2024-29150 | High | 8.8 | 2024-05-07 | An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because o… |
CVE-2024-29149 | High | 7.4 | 2024-05-07 | An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because o… |
CVE-2024-27982 | Medium | 6.5 | 2024-05-07 | The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggl… |
CVE-2024-4596 | Low | 3.7 | 2024-05-07 | A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Ha… |
CVE-2024-34341 | Medium | 5.4 | 2024-05-07 | Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web o… |
CVE-2024-33858 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could… |
CVE-2024-33857 | Critical | 9.6 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the sy… |
CVE-2024-33856 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password end… |
CVE-2024-33748 | Medium | 4.1 | 2024-05-07 | Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier. |
CVE-2024-33146 | Critical | 9.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
CVE-2024-33144 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
CVE-2024-33139 | High | 7.5 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
CVE-2024-4595 | Medium | 6.3 | 2024-05-07 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php… |
CVE-2024-4594 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipul… |
CVE-2024-34523 | High | 7.5 | 2024-05-07 | AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This… |
CVE-2024-34342 | High | 7.1 | 2024-05-07 | react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the d… |
CVE-2024-34084 | High | 7.5 | 2024-05-07 | Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has bee… |
CVE-2024-33124 | Critical | 9.8 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. |
CVE-2024-33122 | Medium | 6.3 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. |
CVE-2024-33120 | Critical | 9.8 | 2024-05-07 | Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows… |
CVE-2024-32867 | Medium | 5.3 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various proble… |
CVE-2024-32664 | Medium | 5.3 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially craf… |
CVE-2024-32663 | High | 7.5 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount… |
CVE-2024-32371 | High | 7.5 | 2024-05-07 | An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain administrative acces… |
CVE-2024-32370 | Critical | 9.8 | 2024-05-07 | An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id… |
CVE-2024-32369 | Medium | 4.3 | 2024-05-07 | SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafte… |
CVE-2024-4593 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multi… |
CVE-2024-4592 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manip… |
CVE-2024-4591 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation… |
CVE-2024-4590 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/sys_info… |
CVE-2024-33783 | Medium | 6.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::SilentMultiPprfReceiver::expand in /Tools/SilentPprf.cpp. This vu… |
CVE-2024-33782 | High | 7.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. This vulnerability a… |
CVE-2024-33781 | High | 7.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function octetStream::get_bytes in /Tools/octetStream.cpp. This vulnerability allows attacker… |
CVE-2024-33780 | Medium | 6.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::copyOut at /Tools/SilentPprf.cpp. This vulnerability allows attac… |
CVE-2024-33434 | Critical | 9.8 | 2024-05-07 | An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to… |
CVE-2024-31456 | High | 7.7 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. Thi… |
CVE-2024-29889 | High | 7.1 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searche… |
CVE-2024-28148 | Medium | 4.3 | 2024-05-07 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue a… |
CVE-2024-4589 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede… |
CVE-2024-4588 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/mytag_add.php. The manip… |
CVE-2024-4587 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulat… |
CVE-2024-4586 | Medium | 4.3 | 2024-05-07 | A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-4601 | Medium | 6.7 | 2024-05-07 | An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute… |
CVE-2024-4600 | High | 7.1 | 2024-05-07 | Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into perform… |
CVE-2024-4585 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipul… |
CVE-2024-4584 | Medium | 5.3 | 2024-05-07 | A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429. Affected by this issue is some unknown functi… |
CVE-2024-4538 | High | 7.5 | 2024-05-07 | IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's event ticket by creati… |
CVE-2024-4537 | High | 7.5 | 2024-05-07 | IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download URL of another use… |