2024 CVEs (page 299)
Page 299 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26980 | High | 8.2 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf If ->ProtocolId is SMB2_TRANSFORM_… |
CVE-2024-26978 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: serial: max310x: fix NULL pointer dereference in I2C instantiation When trying to instant… |
CVE-2024-26977 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally… |
CVE-2024-26976 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-v… |
CVE-2024-26975 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix a NULL pointer dereference A NULL pointer dereference is trigge… |
CVE-2024-26974 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's erro… |
CVE-2024-26973 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes… |
CVE-2024-26971 | High | 7.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays The frequency table arr… |
CVE-2024-26970 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arr… |
CVE-2024-26969 | High | 7.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays The frequency table arr… |
CVE-2024-26968 | High | 7.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays The frequency table arr… |
CVE-2024-26967 | High | 7.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays The frequency table… |
CVE-2024-26966 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table ar… |
CVE-2024-26965 | High | 7.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays The frequency table ar… |
CVE-2024-26964 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() cr… |
CVE-2024-26963 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module ca… |
CVE-2024-26962 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape Fo… |
CVE-2024-26961 | High | 7.0 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key… |
CVE-2024-26960 | High | 7.0 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a the… |
CVE-2024-26959 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuart_close Fix scheduling while atomic BUG in btnxpuart_cl… |
CVE-2024-26958 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning co… |
CVE-2024-26957 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo… |
CVE-2024-26956 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "n… |
CVE-2024-26955 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent kernel bug at submit_bh_wbc() Fix a bug where nilfs_get_block() returns a… |
CVE-2024-26954 | High | 8.1 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() If ->NameOffset of smb2_create_… |
CVE-2024-26953 | Critical | 9.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: esp: fix bad handling of pages from page_pool When the skb is reorganized during esp… |
CVE-2024-26952 | High | 8.3 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial out-of-bounds when buffer offset is invalid I found potencial out-of… |
CVE-2024-26951 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peer… |
CVE-2024-26950 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a… |
CVE-2024-26949 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix NULL pointer dereference when get power limit Because powerplay_table… |
CVE-2024-26948 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add a dc_state NULL check in dc_state_release [How] Check wheather state… |
CVE-2024-26947 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit… |
CVE-2024-26946 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsa… |
CVE-2024-26945 | High | 8.4 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa… |
CVE-2024-26944 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free in do_zone_finish() Shinichiro reported the following us… |
CVE-2024-26943 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: handle kcalloc() allocation failure The kcalloc() in nouveau_dmem_evict_chu… |
CVE-2024-26942 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: phy: qcom: at803x: fix kernel panic with at8031_probe On reworking and splitting the… |
CVE-2024-26941 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau Fix a regression when… |
CVE-2024-26940 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed The driver creates /… |
CVE-2024-26939 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadic… |
CVE-2024-26938 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() If we… |
CVE-2024-26937 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execut… |
CVE-2024-26936 | High | 8.2 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate request buffer size in smb2_allocate_rsp_buf() The response buffer should… |
CVE-2024-26935 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: co… |
CVE-2024-26934 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback… |
CVE-2024-26933 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback rou… |
CVE-2024-26932 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd c… |
CVE-2024-26931 | High | 8.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flus… |
CVE-2024-26930 | High | 7.0 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential… |
CVE-2024-28979 | Medium | 5.1 | 2024-05-01 | Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerab… |
CVE-2024-28978 | Medium | 5.2 | 2024-05-01 | Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. A high privileged remote attacker could potentially explo… |
CVE-2024-33768 | Critical | 9.8 | 2024-05-01 | lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over. |
CVE-2024-33767 | Medium | 5.0 | 2024-05-01 | lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source. |
CVE-2024-33766 | Medium | 5.3 | 2024-05-01 | lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0. |
CVE-2024-33764 | Medium | 5.5 | 2024-05-01 | lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. |
CVE-2024-33763 | High | 7.5 | 2024-05-01 | lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp. |
CVE-2024-4369 | Medium | 6.8 | 2024-05-01 | An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURE_CLIENT_SECRET can be exposed through an environment variabl… |
CVE-2024-4349 | High | 7.3 | 2024-04-30 | A vulnerability has been found in SourceCodester Pisay Online E-Learning System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-4192 | High | 7.8 | 2024-04-30 | Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker… |
CVE-2024-34149 | Medium | 6.3 | 2024-04-30 | In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOT… |
CVE-2024-32970 | High | 7.1 | 2024-04-30 | Phlex is a framework for building object-oriented views in Ruby. In affected versions there is a potential cross-site scripting (XSS) vulnerability that can be… |
CVE-2024-4348 | Medium | 4.3 | 2024-04-30 | A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipul… |
CVE-2024-29466 | High | 8.8 | 2024-04-30 | Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component. |
CVE-2024-3746 | Medium | 5.5 | 2024-04-30 | The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write o… |
CVE-2024-33437 | High | 7.5 | 2024-04-30 | An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS Style Rules. |
CVE-2024-33436 | Medium | 5.3 | 2024-04-30 | An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS variables |
CVE-2024-33383 | High | 7.5 | 2024-04-30 | Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the f… |
CVE-2024-33371 | Medium | 6.1 | 2024-04-30 | Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action… |
CVE-2024-33332 | High | 7.5 | 2024-04-30 | An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant. |
CVE-2024-29384 | High | 7.5 | 2024-04-30 | An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules functions. |
CVE-2024-3411 | Critical | 9.1 | 2024-04-30 | Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predict… |
CVE-2024-34088 | High | 7.5 | 2024-04-30 | In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling fun… |
CVE-2024-28269 | High | 7.2 | 2024-04-30 | ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malic… |
CVE-2024-26331 | High | 7.5 | 2024-04-30 | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attac… |
CVE-2024-22546 | Medium | 6.4 | 2024-04-30 | TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privileges can leverage… |
CVE-2024-33832 | Medium | 6.3 | 2024-04-30 | OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info. |
CVE-2024-33831 | High | 7.4 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scrip… |
CVE-2024-33103 | Medium | 6.1 | 2024-04-30 | An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted… |
CVE-2024-33102 | Medium | 5.4 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or H… |
CVE-2024-33101 | Medium | 6.1 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-23463 | High | 8.8 | 2024-04-30 | Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zsca… |
CVE-2024-29320 | High | 8.1 | 2024-04-30 | Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. |
CVE-2024-4340 | High | 7.5 | 2024-04-30 | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. |
CVE-2024-33465 | High | 7.1 | 2024-04-30 | Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component. |
CVE-2024-33309 | High | 7.5 | 2024-04-30 | An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API e… |
CVE-2024-33308 | Critical | 9.1 | 2024-04-30 | An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Emergency Contact Feat… |
CVE-2024-33275 | Critical | 9.8 | 2024-04-30 | SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super Newsletter module in th… |
CVE-2024-33274 | High | 7.5 | 2024-04-30 | Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information via the Custom Checko… |
CVE-2024-33273 | Critical | 9.8 | 2024-04-30 | SQL injection vulnerability in shipup before v.3.3.0 allows a remote attacker to escalate privileges via the getShopID function. |
CVE-2024-33270 | High | 7.5 | 2024-04-30 | An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the uploadfiles.php com… |
CVE-2024-33267 | Critical | 9.8 | 2024-04-30 | SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontContr… |
CVE-2024-2877 | Medium | 5.5 | 2024-04-30 | Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. The… |
CVE-2024-28716 | High | 7.5 | 2024-04-30 | An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. |
CVE-2024-25938 | High | 8.8 | 2024-04-30 | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code inside a malicious P… |
CVE-2024-25648 | High | 8.8 | 2024-04-30 | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code inside a malicious… |
CVE-2024-25575 | High | 8.8 | 2024-04-30 | A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted Javascript code inside a… |
CVE-2024-23774 | High | 7.8 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe an… |
CVE-2024-23773 | High | 7.8 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component… |
CVE-2024-23772 | Medium | 6.6 | 2024-04-30 | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedulerSvc.exe, KUserAle… |
CVE-2024-2617 | High | 7.2 | 2024-04-30 | A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature was not enabled on… |