2024 CVEs (page 297)
Page 297 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33431 | Medium | 6.5 | 2024-05-01 | An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file. |
CVE-2024-33430 | High | 8.8 | 2024-05-01 | An issue in phiola/src/afilter/pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file. |
CVE-2024-33429 | High | 7.1 | 2024-05-01 | Buffer-Overflow vulnerability at pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via a crafted .wav file. |
CVE-2024-33428 | High | 8.8 | 2024-05-01 | Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file. |
CVE-2024-33424 | Medium | 6.1 | 2024-05-01 | A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2024-33393 | Medium | 6.2 | 2024-05-01 | An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-33304 | Medium | 6.1 | 2024-05-01 | SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" under Add Users. |
CVE-2024-33300 | High | 7.3 | 2024-05-01 | Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by… |
CVE-2024-33292 | High | 8.2 | 2024-05-01 | SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter. |
CVE-2024-29011 | High | 7.5 | 2024-05-01 | Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlier versions. |
CVE-2024-26504 | High | 8.8 | 2024-05-01 | An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter. |
CVE-2024-25458 | High | 7.5 | 2024-05-01 | An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote attacker to obtain… |
CVE-2024-25355 | High | 7.5 | 2024-05-01 | s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component. |
CVE-2024-24313 | High | 7.5 | 2024-05-01 | An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php compon… |
CVE-2024-24312 | High | 7.5 | 2024-05-01 | SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/UserModel.php com… |
CVE-2024-22830 | Medium | 5.3 | 2024-05-01 | Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allo… |
CVE-2024-33442 | Medium | 4.3 | 2024-05-01 | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_post.php component. |
CVE-2024-33078 | Critical | 9.8 | 2024-05-01 | Tencent Libpag v4.3 is vulnerable to Buffer Overflow. A user can send a crafted image to trigger a overflow leading to remote code execution. |
CVE-2024-32213 | Medium | 5.3 | 2024-05-01 | The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords. By default, hard-coded passwords of 10 characters w… |
CVE-2024-32212 | High | 8.1 | 2024-05-01 | SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the ArticleGetGroups… |
CVE-2024-32211 | Medium | 5.5 | 2024-05-01 | An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings… |
CVE-2024-32210 | Medium | 5.3 | 2024-05-01 | The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL connections. |
CVE-2024-30176 | Medium | 5.3 | 2024-05-01 | In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets. |
CVE-2024-29010 | High | 7.1 | 2024-05-01 | The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensiti… |
CVE-2024-33518 | Medium | 5.3 | 2024-05-01 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation… |
CVE-2024-33517 | Medium | 5.3 | 2024-05-01 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation… |
CVE-2024-33516 | Medium | 5.3 | 2024-05-01 | An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. Successful exploitatio… |
CVE-2024-33515 | Medium | 5.3 | 2024-05-01 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vul… |
CVE-2024-33514 | Medium | 5.3 | 2024-05-01 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vul… |
CVE-2024-33513 | Medium | 5.9 | 2024-05-01 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vul… |
CVE-2024-28764 | Medium | 6.5 | 2024-05-01 | IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary c… |
CVE-2024-25015 | High | 7.5 | 2024-05-01 | IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all a… |
CVE-2024-23480 | High | 7.5 | 2024-05-01 | A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2. |
CVE-2024-23457 | High | 7.8 | 2024-05-01 | The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects… |
CVE-2024-20378 | High | 7.5 | 2024-05-01 | A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive informat… |
CVE-2024-20376 | High | 7.5 | 2024-05-01 | A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to… |
CVE-2024-20357 | Medium | 5.9 | 2024-05-01 | A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. … |
CVE-2024-33820 | High | 7.5 | 2024-05-01 | Totolink AC1200 Wireless Dual Band Gigabit Router A3002R_V4 Firmware V4.0.0-B20230531.1404 is vulnerable to Buffer Overflow via the formWlEncrypt function of t… |
CVE-2024-28893 | High | 7.7 | 2024-05-01 | Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extr… |
CVE-2024-33512 | Critical | 9.8 | 2024-05-01 | There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remote code execution… |
CVE-2024-33511 | Critical | 9.8 | 2024-05-01 | There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execution by sending spec… |
CVE-2024-26305 | Critical | 9.8 | 2024-05-01 | There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2024-26304 | Critical | 9.8 | 2024-05-01 | There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending special… |
CVE-2024-24912 | Medium | 6.7 | 2024-05-01 | A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulne… |
CVE-2024-4368 | High | 8.8 | 2024-05-01 | Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-4331 | High | 8.8 | 2024-05-01 | Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2024-4060 | Medium | 6.5 | 2024-05-01 | Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-4059 | Medium | 6.5 | 2024-05-01 | Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. (Chromium secur… |
CVE-2024-4058 | High | 8.8 | 2024-05-01 | Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-33775 | Critical | 9.8 | 2024-05-01 | An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet. |
CVE-2024-31413 | Medium | 5.9 | 2024-05-01 | Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower… |
CVE-2024-31412 | High | 7.8 | 2024-05-01 | Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may l… |
CVE-2024-28775 | Medium | 4.4 | 2024-05-01 | IBM WebSphere Automation 1.7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2024-27392 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() When nvme_identify_n… |
CVE-2024-27391 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: do not realloc workqueue everytime an interface is added Commit 09ed8bfc5… |
CVE-2024-27390 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the p… |
CVE-2024-27389 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with reco… |
CVE-2024-27388 | Critical | 9.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be free… |
CVE-2024-27080 | Medium | 4.7 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopp… |
CVE-2024-27079 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix NULL domain on device release In the kdump kernel, the IOMMU operates in… |
CVE-2024-27078 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be dealloc… |
CVE-2024-27077 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. nam… |
CVE-2024-27076 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak Free the memory allocated in v4… |
CVE-2024-27075 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked ar… |
CVE-2024-27074 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. g… |
CVE-2024-27073 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa71… |
CVE-2024-27072 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Remove useless locks in usbtv_video_free() Remove locks calls in usbtv_vide… |
CVE-2024-27071 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: backlight: hx8357: Fix potential NULL pointer dereference The "im" pins are optional. Add… |
CVE-2024-27070 | High | 7.1 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault syzbot reports a f2fs bug a… |
CVE-2024-27069 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARN_ON in ovl_verify_area() syzbot hit an assertion in copy up data loop whic… |
CVE-2024-27068 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path If dev… |
CVE-2024-27067 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: xen/evtchn: avoid WARN() when unbinding an event channel When unbinding a user event chan… |
CVE-2024-27066 | High | 7.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are… |
CVE-2024-27065 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping tra… |
CVE-2024-27064 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain If nft_netdev_register_hook… |
CVE-2024-27063 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7… |
CVE-2024-27062 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking un… |
CVE-2024-27061 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Fix use after free in unprepare sun8i_ce_cipher_unprepare should be ca… |
CVE-2024-27060 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported th… |
CVE-2024-27059 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver i… |
CVE-2024-27058 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: tmpfs: fix race on handling dquot rbtree A syzkaller reproducer found a race while attemp… |
CVE-2024-27057 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is… |
CVE-2024-27056 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that… |
CVE-2024-27054 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with th… |
CVE-2024-27053 | High | 8.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect… |
CVE-2024-27052 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be runni… |
CVE-2024-27051 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_ge… |
CVE-2024-27050 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTS_SET() macro in bpf_xdp_query() When the feature_flags and xdp_zc_max_seg… |
CVE-2024-27049 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH]… |
CVE-2024-27048 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op allocation failure The kzalloc() in brcmf_pmksa_v3_op() wi… |
CVE-2024-27047 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array The phy_get_internal_delay… |
CVE-2024-27046 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_… |
CVE-2024-27045 | High | 7.0 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' Tell snprint… |
CVE-2024-27044 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_fun… |
CVE-2024-27043 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal t… |
CVE-2024-27041 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() Since 'adev->dm.dc'… |
CVE-2024-27040 | Medium | 4.7 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' In the first… |
CVE-2024-27039 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just… |
CVE-2024-27038 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a N… |
CVE-2024-27037 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: zynq: Prevent null pointer dereference caused by kmalloc failure The kmalloc() in zy… |