2024 CVEs (page 324)
Page 324 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23592 | Medium | 6.3 | 2024-04-05 | An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to r… |
CVE-2024-3354 | High | 7.3 | 2024-04-05 | A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. It has been classified as critical. Affected is an unknown funct… |
CVE-2024-3353 | High | 7.3 | 2024-04-05 | A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0 and classified as critical. This issue affects some unknown proce… |
CVE-2024-2312 | Medium | 6.7 | 2024-04-05 | GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to… |
CVE-2024-29783 | Medium | 6.7 | 2024-04-05 | In tmu_get_tr_thresholds, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additio… |
CVE-2024-29782 | Medium | 5.5 | 2024-04-05 | In tmu_get_tr_num_thresholds of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure wi… |
CVE-2024-29757 | High | 7.3 | 2024-04-05 | there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privi… |
CVE-2024-29756 | Critical | 9.8 | 2024-04-05 | In afe_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with no addition… |
CVE-2024-29755 | Medium | 4.4 | 2024-04-05 | In tmu_get_pi of tmu.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additi… |
CVE-2024-29754 | Medium | 6.2 | 2024-04-05 | In TMU_IPC_GET_TABLE, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional… |
CVE-2024-29753 | High | 7.7 | 2024-04-05 | In tmu_set_control_temp_step of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege… |
CVE-2024-29752 | High | 7.8 | 2024-04-05 | In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege… |
CVE-2024-29751 | Medium | 5.5 | 2024-04-05 | In asn1_ec_pkey_parse_p384 of asn1_common.c, there is a possible OOB Read due to a missing null check. This could lead to local information disclosure with no… |
CVE-2024-29750 | Medium | 5.5 | 2024-04-05 | In km_exp_did_inner of kmv.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no add… |
CVE-2024-29749 | High | 8.4 | 2024-04-05 | In tmu_set_tr_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with… |
CVE-2024-29748 | High | 7.8 | 2024-04-05 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n… |
CVE-2024-29747 | Medium | 5.9 | 2024-04-05 | In _dvfs_get_lv of dvfs.c, there is a possible out of bounds read due to a missing null check. This could lead to local information disclosure with no addition… |
CVE-2024-29746 | High | 8.4 | 2024-04-05 | In lpm_req_handler of lpm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no… |
CVE-2024-29745 | Medium | 5.5 | 2024-04-05 | there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2024-29744 | Medium | 5.5 | 2024-04-05 | In tmu_get_gov_time_windows, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no addi… |
CVE-2024-29743 | High | 7.7 | 2024-04-05 | In tmu_set_temp_lut of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no a… |
CVE-2024-29742 | Medium | 5.5 | 2024-04-05 | In apply_minlock_constraint of dvfs.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure wi… |
CVE-2024-29741 | High | 7.8 | 2024-04-05 | In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation of privilege with no… |
CVE-2024-29740 | High | 7.4 | 2024-04-05 | In tmu_set_table of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no addi… |
CVE-2024-29739 | Medium | 5.5 | 2024-04-05 | In tmu_get_temp_lut of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no add… |
CVE-2024-29738 | Medium | 5.5 | 2024-04-05 | In gov_init, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution… |
CVE-2024-27232 | Medium | 5.5 | 2024-04-05 | In asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check. This could lead to local information disclosure with no addit… |
CVE-2024-27231 | Medium | 5.9 | 2024-04-05 | In tmu_get_tr_stats of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no add… |
CVE-2024-3352 | High | 7.3 | 2024-04-05 | A vulnerability has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0 and classified as critical. This vulnerability affects unkno… |
CVE-2024-0081 | High | 8.6 | 2024-04-05 | NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttl… |
CVE-2024-3351 | High | 7.3 | 2024-04-05 | A vulnerability, which was classified as critical, was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affects an unknown part… |
CVE-2024-3350 | High | 7.3 | 2024-04-05 | A vulnerability, which was classified as critical, has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected by this issue i… |
CVE-2024-31851 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthen… |
CVE-2024-31850 | High | 8.6 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthent… |
CVE-2024-31849 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unaut… |
CVE-2024-31848 | Critical | 9.8 | 2024-04-05 | A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an un… |
CVE-2024-28065 | Medium | 5.9 | 2024-04-05 | In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash. |
CVE-2024-22004 | Critical | 10.0 | 2024-04-05 | Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure memory from the Tr… |
CVE-2024-0080 | Low | 2.8 | 2024-04-05 | NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input… |
CVE-2024-0076 | Low | 3.3 | 2024-04-05 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a user into reading a… |
CVE-2024-0072 | Low | 3.3 | 2024-04-05 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a user into reading a… |
CVE-2024-3349 | High | 7.3 | 2024-04-05 | A vulnerability classified as critical was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected by this vulnerability is an unkn… |
CVE-2024-3348 | High | 7.3 | 2024-04-05 | A vulnerability classified as critical has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected is an unknown function of t… |
CVE-2024-3347 | High | 7.3 | 2024-04-05 | A vulnerability was found in SourceCodester Airline Ticket Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-3346 | Medium | 6.3 | 2024-04-05 | A vulnerability was found in Byzoro Smart S80 up to 20240328. It has been declared as critical. This vulnerability affects unknown code of the file /log/webmai… |
CVE-2024-31852 | Medium | 5.9 | 2024-04-05 | LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploit… |
CVE-2024-31220 | High | 7.3 | 2024-04-05 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbi… |
CVE-2024-31218 | Critical | 9.8 | 2024-04-05 | Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject… |
CVE-2024-31213 | Low | 3.5 | 2024-04-05 | InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after… |
CVE-2024-2499 | Medium | 6.4 | 2024-04-05 | The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode in all ver… |
CVE-2024-2380 | Medium | 4.6 | 2024-04-05 | Stored XSS in graph rendering in Checkmk <2.3.0b4. |
CVE-2024-31083 | High | 7.8 | 2024-04-05 | A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new g… |
CVE-2024-2447 | Medium | 6.5 | 2024-04-05 | Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of pos… |
CVE-2024-29221 | Medium | 4.7 | 2024-04-05 | Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access cont… |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-27437 | Medium | 5.5 | 2024-04-05 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disable auto-enable of exclusive INTx IRQ Currently for devices requiring maski… |
CVE-2024-26814 | Medium | 5.5 | 2024-04-05 | In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfd_ctx trigger poin… |
CVE-2024-26813 | Medium | 5.5 | 2024-04-05 | In the Linux kernel, the following vulnerability has been resolved: vfio/platform: Create persistent IRQ handlers The vfio-platform SET_IRQS ioctl currently… |
CVE-2024-26812 | High | 7.8 | 2024-04-05 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INTx handler A vulnerability exists where the eventfd for INT… |
CVE-2024-26810 | High | 7.8 | 2024-04-05 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to… |
CVE-2024-21848 | Low | 3.1 | 2024-04-05 | Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in… |
CVE-2024-3217 | High | 8.8 | 2024-04-05 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and inc… |
CVE-2024-30891 | High | 8.8 | 2024-04-05 | A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrar… |
CVE-2024-30849 | Critical | 9.8 | 2024-04-05 | Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter i… |
CVE-2024-2115 | High | 8.8 | 2024-04-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due… |
CVE-2024-29863 | High | 7.8 | 2024-04-05 | A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may allow an existing l… |
CVE-2024-26329 | Medium | 6.2 | 2024-04-05 | Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. |
CVE-2024-29672 | High | 8.8 | 2024-04-05 | Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in K… |
CVE-2024-27448 | Critical | 9.1 | 2024-04-05 | MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary c… |
CVE-2024-22363 | High | 7.5 | 2024-04-05 | SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). |
CVE-2024-2509 | Medium | 6.5 | 2024-04-05 | The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a p… |
CVE-2024-3321 | Low | 3.5 | 2024-04-05 | A vulnerability classified as problematic has been found in SourceCodester eLearning System 1.0. This affects an unknown part of the component Maintenance Modu… |
CVE-2024-3320 | Low | 3.5 | 2024-04-05 | A vulnerability was found in SourceCodester eLearning System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The m… |
CVE-2024-31498 | High | 8.8 | 2024-04-04 | Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Admi… |
CVE-2024-31212 | Medium | 6.7 | 2024-04-04 | InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrati… |
CVE-2024-31211 | Medium | 5.5 | 2024-04-04 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()… |
CVE-2024-31210 | High | 7.6 | 2024-04-04 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administra… |
CVE-2024-31206 | High | 8.2 | 2024-04-04 | dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, w… |
CVE-2024-27981 | Critical | 9.8 | 2024-04-04 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a mal… |
CVE-2024-21894 | Critical | 9.8 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |
CVE-2024-3316 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. Affected by this vulnerability is an u… |
CVE-2024-29981 | Medium | 4.3 | 2024-04-04 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-29049 | Medium | 4.1 | 2024-04-04 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
CVE-2024-3315 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been classified as critical. Affected is an unknown function of t… |
CVE-2024-3314 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of… |
CVE-2024-3311 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of… |
CVE-2024-31204 | Medium | 6.1 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30270 | Medium | 6.2 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30264 | High | 8.1 | 2024-04-04 | Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attack… |
CVE-2024-30255 | Medium | 5.3 | 2024-04-04 | Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulner… |
CVE-2024-29387 | High | 8.8 | 2024-04-04 | projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php. |
CVE-2024-29386 | Medium | 5.4 | 2024-04-04 | projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php. |
CVE-2024-27316 | High | 7.5 | 2024-04-04 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not sto… |
CVE-2024-24795 | Medium | 6.3 | 2024-04-04 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to ca… |
CVE-2024-22053 | High | 8.2 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |
CVE-2024-22052 | High | 7.5 | 2024-04-04 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious u… |
CVE-2024-22023 | Medium | 5.3 | 2024-04-04 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker… |
CVE-2024-30254 | Medium | 5.8 | 2024-04-04 | MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files i… |
CVE-2024-30252 | Low | 2.6 | 2024-04-04 | Livemarks is a browser extension that provides RSS feed bookmark folders. Versions of Livemarks prior to 3.7 are vulnerable to cross-site request forgery. A ma… |
CVE-2024-30249 | High | 8.6 | 2024-04-04 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR1-20240330.101522-15` impacts pub… |