2024 CVEs (page 310)
Page 310 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26838 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assoc… |
CVE-2024-26837 | Medium | 4.7 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change… |
CVE-2024-26836 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix password opcode ordering for workstations The Lenovo worksta… |
CVE-2024-26835 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dorman… |
CVE-2024-26834 | High | 7.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: release dst in case direct xmit path is used Direct xmit doe… |
CVE-2024-26833 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory leak in dm_sw_fini() After destroying dmub_srv, the memory as… |
CVE-2024-26832 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix missing folio cleanup in writeback race path In zswap_writeback_entry(), a… |
CVE-2024-26831 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Fix handshake_req_destroy_test1 Recently, handshake_req_destroy_test1 star… |
CVE-2024-26830 | High | 8.4 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to remove administratively set MAC Currently when PF admi… |
CVE-2024-26829 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: media: ir_toy: fix a memleak in irtoy_tx When irtoy_command fails, buf should be freed si… |
CVE-2024-26828 | Critical | 9.4 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer… |
CVE-2024-26826 | High | 7.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow… |
CVE-2024-26825 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup rx_data_reassembly skb is sto… |
CVE-2024-26824 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - Remove bogus SGL free on zero-length error path When a zero-length m… |
CVE-2024-26823 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems While refactoring the wa… |
CVE-2024-26822 | High | 8.7 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cru… |
CVE-2024-26820 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver… |
CVE-2024-26818 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: tools/rtla: Fix clang warning about mount_point var size clang is reporting this warning… |
CVE-2024-1350 | Medium | 5.3 | 2024-04-17 | Missing Authorization vulnerability in Prasidhda Malla Honeypot for WP Comment.This issue affects Honeypot for WP Comment: from n/a through 2.2.3. |
CVE-2024-32546 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issu… |
CVE-2024-32545 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Refle… |
CVE-2024-32544 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netgsm allows Reflected XSS.This issue affects Netgsm: fr… |
CVE-2024-32543 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue… |
CVE-2024-32542 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS… |
CVE-2024-32541 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Battenberg WP-Cufon allows Stored XSS.This issue a… |
CVE-2024-32540 | Medium | 5.9 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Web357 Fixed HTML Toolbar allows Stored XSS.This issue af… |
CVE-2024-32539 | Medium | 6.5 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This… |
CVE-2024-32538 | Medium | 6.5 | 2024-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Joshua Eldridge Easy CountDowner allows Stored XSS.This issue affects Easy CountDowner: from n/a through 1.0… |
CVE-2024-32536 | Medium | 6.5 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trade Pips WP TradingView allows Stored XSS.This issue af… |
CVE-2024-32535 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jojaba Access Category Password allows Reflected XSS.This… |
CVE-2024-32534 | Medium | 5.9 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored… |
CVE-2024-32533 | High | 7.1 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Shaw LH Add Media From Url allows Reflected XSS.Thi… |
CVE-2024-24856 | Medium | 5.3 | 2024-04-17 | The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation, but the subsequent code directly dereferences the pointer that… |
CVE-2024-3847 | Medium | 6.1 | 2024-04-17 | Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2024-3846 | Medium | 4.3 | 2024-04-17 | Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2024-3845 | Medium | 4.3 | 2024-04-17 | Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML pa… |
CVE-2024-3844 | Medium | 4.3 | 2024-04-17 | Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extens… |
CVE-2024-3843 | Medium | 4.3 | 2024-04-17 | Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2024-3841 | Medium | 6.1 | 2024-04-17 | Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged… |
CVE-2024-3840 | High | 7.5 | 2024-04-17 | Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2024-3839 | Medium | 6.5 | 2024-04-17 | Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2024-3838 | Medium | 5.5 | 2024-04-17 | Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform… |
CVE-2024-3837 | High | 8.8 | 2024-04-17 | Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2024-3834 | High | 8.8 | 2024-04-17 | Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2024-3833 | High | 8.8 | 2024-04-17 | Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML… |
CVE-2024-3832 | High | 8.8 | 2024-04-17 | Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Ch… |
CVE-2024-32550 | High | 7.1 | 2024-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in BMI Adult & Kid Calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through… |
CVE-2024-32549 | High | 7.1 | 2024-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Microkid Related Posts for WordPress allows Cross-Site Scripting (XSS).This issue affects Related Posts for… |
CVE-2024-32548 | Medium | 5.9 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hideki Tanaka What's New Generator allows Stored XSS.This… |
CVE-2024-32547 | Medium | 5.8 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond Code Insert Manager (Q2W3 Inc Manager) allows Re… |
CVE-2024-32532 | Medium | 5.3 | 2024-04-17 | Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6. |
CVE-2024-32525 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6. |
CVE-2024-32524 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a throu… |
CVE-2024-32522 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in Jaed Mosharraf & Pluginbazar Team Open Close WooCommerce Store.This issue affects Open Close WooCommerce Store: from n/a… |
CVE-2024-32520 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in WPClever WPC Grouped Product for WooCommerce.This issue affects WPC Grouped Product for WooCommerce: from n/a through 4… |
CVE-2024-32519 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in GutenGeek GG Woo Feed for WooCommerce.This issue affects GG Woo Feed for WooCommerce: from n/a through 1.2.6. |
CVE-2024-32518 | Medium | 5.3 | 2024-04-17 | Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0. |
CVE-2024-32517 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce by Binary Carpenter.This issue affects… |
CVE-2024-32516 | Medium | 4.3 | 2024-04-17 | Missing Authorization vulnerability in Palscode Multi Currency For WooCommerce.This issue affects Multi Currency For WooCommerce: from n/a through 1.5.5. |
CVE-2024-32515 | Medium | 5.4 | 2024-04-17 | Missing Authorization vulnerability in Qamar Sheeraz, Nasir Ahmad Mega Addons For Elementor.This issue affects Mega Addons For Elementor: from n/a through 1.8. |
CVE-2024-32514 | Critical | 9.9 | 2024-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker.This issue affects WP Poll Maker: fr… |
CVE-2024-32513 | Medium | 5.3 | 2024-04-17 | Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooComme… |
CVE-2024-32509 | Medium | 6.5 | 2024-04-17 | Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/… |
CVE-2024-32506 | Medium | 5.4 | 2024-04-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. |
CVE-2024-22440 | Medium | 6.8 | 2024-04-17 | A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive info… |
CVE-2024-2309 | Medium | 4.8 | 2024-04-17 | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its se… |
CVE-2024-2118 | Medium | 5.9 | 2024-04-17 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high p… |
CVE-2024-2102 | Medium | 4.7 | 2024-04-17 | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking a… |
CVE-2024-2101 | Medium | 5.7 | 2024-04-17 | The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing cus… |
CVE-2024-1219 | Medium | 5.3 | 2024-04-17 | The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2024-0868 | Medium | 5.3 | 2024-04-17 | The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing… |
CVE-2024-22329 | Medium | 4.3 | 2024-04-17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery… |
CVE-2024-22354 | High | 7.0 | 2024-04-17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injec… |
CVE-2024-31680 | High | 8.8 | 2024-04-17 | File Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting system v.1.0 allows a local attacker to execute arbitrary code v… |
CVE-2024-31503 | High | 7.5 | 2024-04-17 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protect… |
CVE-2024-31760 | Medium | 4.7 | 2024-04-16 | An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component. |
CVE-2024-31759 | High | 8.8 | 2024-04-16 | An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function. |
CVE-2024-29402 | Medium | 4.3 | 2024-04-16 | cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity. |
CVE-2024-29291 | | 2024-04-16 | An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed b… | |
CVE-2024-31887 | High | 7.5 | 2024-04-16 | IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651. |
CVE-2024-31452 | High | 8.1 | 2024-04-16 | OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass wh… |
CVE-2024-27086 | Low | 3.9 | 2024-04-16 | The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) u… |
CVE-2024-21121 | Medium | 6.5 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21120 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21119 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21118 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21117 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8… |
CVE-2024-21116 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21115 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21114 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21113 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21112 | High | 8.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21111 | High | 7.8 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21110 | High | 7.3 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21109 | Medium | 5.9 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Diffic… |
CVE-2024-21108 | Low | 3.3 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21107 | Medium | 6.7 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21106 | Medium | 6.5 | 2024-04-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily… |
CVE-2024-21105 | Low | 2.0 | 2024-04-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerab… |
CVE-2024-21104 | Medium | 6.5 | 2024-04-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |