2024 CVEs (page 325)
Page 325 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3321 | Low | 3.5 | 2024-04-05 | A vulnerability classified as problematic has been found in SourceCodester eLearning System 1.0. This affects an unknown part of the component Maintenance Modu… |
CVE-2024-3320 | Low | 3.5 | 2024-04-05 | A vulnerability was found in SourceCodester eLearning System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The m… |
CVE-2024-31498 | High | 8.8 | 2024-04-04 | Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Admi… |
CVE-2024-31212 | Medium | 6.7 | 2024-04-04 | InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrati… |
CVE-2024-31211 | Medium | 5.5 | 2024-04-04 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()… |
CVE-2024-31210 | High | 7.6 | 2024-04-04 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administra… |
CVE-2024-31206 | High | 8.2 | 2024-04-04 | dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, w… |
CVE-2024-27981 | Critical | 9.8 | 2024-04-04 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a mal… |
CVE-2024-21894 | Critical | 9.8 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |
CVE-2024-3316 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. Affected by this vulnerability is an u… |
CVE-2024-29981 | Medium | 4.3 | 2024-04-04 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-29049 | Medium | 4.1 | 2024-04-04 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
CVE-2024-3315 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been classified as critical. Affected is an unknown function of t… |
CVE-2024-3314 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of… |
CVE-2024-3311 | Medium | 6.3 | 2024-04-04 | A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of… |
CVE-2024-31204 | Medium | 6.1 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30270 | Medium | 6.2 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-30264 | High | 8.1 | 2024-04-04 | Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attack… |
CVE-2024-30255 | Medium | 5.3 | 2024-04-04 | Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulner… |
CVE-2024-29387 | High | 8.8 | 2024-04-04 | projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php. |
CVE-2024-29386 | Medium | 5.4 | 2024-04-04 | projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php. |
CVE-2024-27316 | High | 7.5 | 2024-04-04 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not sto… |
CVE-2024-24795 | Medium | 6.3 | 2024-04-04 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to ca… |
CVE-2024-22053 | High | 8.2 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |
CVE-2024-22052 | High | 7.5 | 2024-04-04 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious u… |
CVE-2024-22023 | Medium | 5.3 | 2024-04-04 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker… |
CVE-2024-30254 | Medium | 5.8 | 2024-04-04 | MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files i… |
CVE-2024-30252 | Low | 2.6 | 2024-04-04 | Livemarks is a browser extension that provides RSS feed bookmark folders. Versions of Livemarks prior to 3.7 are vulnerable to cross-site request forgery. A ma… |
CVE-2024-30249 | High | 8.6 | 2024-04-04 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR1-20240330.101522-15` impacts pub… |
CVE-2024-29193 | Medium | 6.1 | 2024-04-04 | gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the a… |
CVE-2024-25007 | High | 7.1 | 2024-04-04 | Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Fo… |
CVE-2024-2660 | Medium | 6.4 | 2024-04-04 | Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerabi… |
CVE-2024-29192 | High | 8.8 | 2024-04-04 | gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modi… |
CVE-2024-28787 | High | 8.7 | 2024-04-04 | IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote attacker to obtain highly sensitive priva… |
CVE-2024-27268 | Medium | 5.9 | 2024-04-04 | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remot… |
CVE-2024-25709 | Medium | 6.1 | 2024-04-04 | There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to… |
CVE-2024-25708 | Medium | 4.8 | 2024-04-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, au… |
CVE-2024-25706 | Medium | 6.1 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when… |
CVE-2024-25705 | Medium | 5.4 | 2024-04-04 | There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a rem… |
CVE-2024-25700 | Medium | 4.8 | 2024-04-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, auth… |
CVE-2024-25699 | High | 8.5 | 2024-04-04 | There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux… |
CVE-2024-25698 | Medium | 6.1 | 2024-04-04 | There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a rem… |
CVE-2024-25697 | Medium | 5.4 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a craft… |
CVE-2024-25696 | Medium | 4.8 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a craft… |
CVE-2024-25695 | High | 7.2 | 2024-04-04 | There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input… |
CVE-2024-25693 | Critical | 9.9 | 2024-04-04 | There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file… |
CVE-2024-25692 | Medium | 5.4 | 2024-04-04 | There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated at… |
CVE-2024-25690 | Medium | 4.7 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2024-30263 | High | 7.7 | 2024-04-04 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro… |
CVE-2024-31215 | Medium | 6.3 | 2024-04-04 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase… |
CVE-2024-31209 | Medium | 5.3 | 2024-04-04 | oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:g… |
CVE-2024-31207 | Medium | 5.9 | 2024-04-04 | Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does… |
CVE-2024-30266 | Low | 3.3 | 2024-04-04 | wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAsse… |
CVE-2024-30260 | Low | 3.9 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear t… |
CVE-2024-2103 | Medium | 6.5 | 2024-04-04 | Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories… |
CVE-2024-3299 | High | 7.8 | 2024-04-04 | Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS… |
CVE-2024-3298 | High | 7.8 | 2024-04-04 | Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS… |
CVE-2024-3250 | Medium | 6.5 | 2024-04-04 | It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local user… |
CVE-2024-3116 | High | 7.4 | 2024-04-04 | pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute… |
CVE-2024-30261 | Low | 2.6 | 2024-04-04 | Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept… |
CVE-2024-30250 | High | 7.5 | 2024-04-04 | Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions f… |
CVE-2024-29191 | Medium | 6.1 | 2024-04-04 | gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the… |
CVE-2024-29182 | Medium | 6.1 | 2024-04-04 | Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Collabora Online. An att… |
CVE-2024-28871 | High | 7.5 | 2024-04-04 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessi… |
CVE-2024-28182 | Medium | 5.3 | 2024-04-04 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number… |
CVE-2024-27919 | High | 7.5 | 2024-04-04 | Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTIN… |
CVE-2024-22189 | High | 7.5 | 2024-04-04 | quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of… |
CVE-2024-3296 | Medium | 5.9 | 2024-04-04 | A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-styl… |
CVE-2024-31082 | High | 7.3 | 2024-04-04 | A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length val… |
CVE-2024-31081 | High | 7.3 | 2024-04-04 | A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length valu… |
CVE-2024-31080 | High | 7.3 | 2024-04-04 | A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length valu… |
CVE-2024-2759 | High | 7.5 | 2024-04-04 | Improper access control vulnerability in Apaczka plugin for PrestaShop allows information gathering from saved templates without authentication.This issue affe… |
CVE-2024-2700 | High | 7.0 | 2024-04-04 | A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build… |
CVE-2024-27575 | High | 7.5 | 2024-04-04 | INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/di… |
CVE-2024-3262 | Medium | 5.5 | 2024-04-04 | Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve se… |
CVE-2024-26809 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already… |
CVE-2024-26808 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove n… |
CVE-2024-26807 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with… |
CVE-2024-26806 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks The ->ru… |
CVE-2024-26805 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the follow… |
CVE-2024-26804 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan spl… |
CVE-2024-26803 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: net: veth: clear GRO when clearing XDP even when down veth sets NETIF_F_GRO automatically… |
CVE-2024-26802 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: stmmac: Clear variable when destroying workqueue Currently when suspending driver and sto… |
CVE-2024-26801 | High | 8.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HA… |
CVE-2024-26800 | Critical | 9.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the… |
CVE-2024-26799 | High | 7.0 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix uninitialized pointer dmactl In the case where __lpass_get_dmactl_handle… |
CVE-2024-26798 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev… |
CVE-2024-26797 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent potential buffer overflow in map_hw_resources Adds a check in th… |
CVE-2024-26796 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctr_get_width function for legacy is not defined With parameters CONFIG_RI… |
CVE-2024-26795 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of v… |
CVE-2024-26793 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations s… |
CVE-2024-26792 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating… |
CVE-2024-26791 | High | 7.1 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device na… |
CVE-2024-26790 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read There is chip (ls1028a) e… |
CVE-2024-26789 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementat… |
CVE-2024-26788 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the… |
CVE-2024-26787 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API overlapping mappings warning Turning on CONFIG_DMA_API_DEBU… |
CVE-2024-26786 | High | 7.8 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: … |
CVE-2024-26785 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix protection fault in iommufd_test_syz_conv_iova Syzkaller reported the follow… |
CVE-2024-26784 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal On unloading of the scmi_… |