2024 CVEs (page 329)
Page 329 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30808 | Low | 2.7 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Den… |
CVE-2024-30807 | High | 7.5 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp, leading to a Denia… |
CVE-2024-30806 | Medium | 6.5 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Serv… |
CVE-2024-30335 | High | 7.1 | 2024-04-02 | Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive… |
CVE-2024-3151 | Medium | 4.3 | 2024-04-02 | A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown functi… |
CVE-2024-2435 | Medium | 4.3 | 2024-04-02 | For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that… |
CVE-2024-28287 | High | 7.3 | 2024-04-02 | A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL. |
CVE-2024-22248 | High | 7.1 | 2024-04-02 | VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker controlled domain due t… |
CVE-2024-22247 | Medium | 4.8 | 2024-04-02 | VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge applian… |
CVE-2024-22246 | High | 7.4 | 2024-04-02 | VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local acce… |
CVE-2024-30248 | High | 7.7 | 2024-04-02 | Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As… |
CVE-2024-22780 | Medium | 6.1 | 2024-04-02 | Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the errmsg parameter. |
CVE-2024-30965 | High | 8.8 | 2024-04-02 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php. |
CVE-2024-30621 | Critical | 9.8 | 2024-04-02 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan. |
CVE-2024-30620 | Critical | 9.8 | 2024-04-02 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan. |
CVE-2024-30946 | Medium | 5.5 | 2024-04-02 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php. |
CVE-2024-2389 | Critical | 10.0 | 2024-04-02 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain ent… |
CVE-2024-29514 | High | 8.8 | 2024-04-02 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-29949 | High | 7.2 | 2024-04-02 | There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary comma… |
CVE-2024-29948 | Low | 3.8 | 2024-04-02 | There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted me… |
CVE-2024-29947 | Low | 2.7 | 2024-04-02 | There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send s… |
CVE-2024-2745 | Low | 3.3 | 2024-04-02 | Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through qu… |
CVE-2024-1946 | Medium | 6.4 | 2024-04-02 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 3.1.2 due to i… |
CVE-2024-1807 | Medium | 6.5 | 2024-04-02 | The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the p… |
CVE-2024-1732 | Medium | 5.3 | 2024-04-02 | The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o… |
CVE-2024-2931 | Medium | 4.3 | 2024-04-02 | The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpf… |
CVE-2024-31005 | High | 8.1 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment |
CVE-2024-31004 | Critical | 9.8 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment. |
CVE-2024-31003 | High | 8.8 | 2024-04-02 | Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4B… |
CVE-2024-31002 | Critical | 9.8 | 2024-04-02 | Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache() at Ap4Utils.cpp… |
CVE-2024-20799 | Medium | 5.4 | 2024-04-02 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-1300 | Medium | 5.4 | 2024-04-02 | A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server na… |
CVE-2024-2925 | Medium | 6.4 | 2024-04-02 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in all versions up… |
CVE-2024-2839 | Medium | 6.4 | 2024-04-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up t… |
CVE-2024-29276 | Critical | 9.8 | 2024-04-02 | An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.cla… |
CVE-2024-29086 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause DOS through stack overflow. |
CVE-2024-29074 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper input. |
CVE-2024-28951 | Medium | 5.5 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-28226 | High | 8.1 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input. |
CVE-2024-26684 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56… |
CVE-2024-26683 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation… |
CVE-2024-26682 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit… |
CVE-2024-26681 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: avoid potential loop in nsim_dev_trap_report_work() Many syzbot reports includ… |
CVE-2024-26680 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aq_ring_hwts_rx_alloc() maps ex… |
CVE-2024-26679 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without ho… |
CVE-2024-26678 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section… |
CVE-2024-26677 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of de… |
CVE-2024-26676 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0… |
CVE-2024-26675 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_O… |
CVE-2024-26674 | High | 7.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error inje… |
CVE-2024-26673 | High | 7.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disall… |
CVE-2024-26672 | High | 7.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get… |
CVE-2024-26671 | Medium | 4.7 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue(… |
CVE-2024-26670 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD Currently the ARM64_WORKAROUND… |
CVE-2024-26669 | High | 7.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device t… |
CVE-2024-26668 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus conf… |
CVE-2024-26667 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup The commit 8b45a26f… |
CVE-2024-26666 | High | 7.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection… |
CVE-2024-26665 | Critical | 9.1 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is bu… |
CVE-2024-26664 | High | 7.8 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access Fix a bug that pdata->cpu_map[] is set… |
CVE-2024-26663 | High | 7.8 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the f… |
CVE-2024-26662 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' 'panel_c… |
CVE-2024-26661 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_i… |
CVE-2024-26660 | High | 7.0 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc… |
CVE-2024-26659 | High | 7.8 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids a… |
CVE-2024-26658 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: bcachefs: grab s_umount only if snapshotting When I was testing mongodb over bcachefs wit… |
CVE-2024-26657 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgp… |
CVE-2024-26656 | High | 7.8 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_ge… |
CVE-2024-24581 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write. |
CVE-2024-22180 | Low | 3.3 | 2024-04-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free. |
CVE-2024-22177 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission. |
CVE-2024-22098 | Medium | 6.5 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. |
CVE-2024-22092 | High | 7.7 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action. |
CVE-2024-21834 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-2924 | Medium | 6.4 | 2024-04-02 | The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includi… |
CVE-2024-2791 | Medium | 6.4 | 2024-04-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, an… |
CVE-2024-1504 | Medium | 4.3 | 2024-04-02 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is… |
CVE-2024-1274 | Medium | 5.4 | 2024-04-02 | The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perfor… |
CVE-2024-2369 | Medium | 5.4 | 2024-04-02 | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/po… |
CVE-2024-25187 | High | 8.6 | 2024-04-02 | Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html. |
CVE-2024-3160 | Medium | 5.3 | 2024-04-02 | ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 10… |
CVE-2024-20854 | Medium | 5.9 | 2024-04-02 | Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in Android 13, and 14.0.01.0… |
CVE-2024-20853 | Medium | 5.1 | 2024-04-02 | Improper verification of intent by broadcast receiver vulnerability in ThemeStore prior to 5.3.05.2 allows local attackers to write arbitrary files to sandbox… |
CVE-2024-20852 | Medium | 5.9 | 2024-04-02 | Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configur… |
CVE-2024-20851 | Medium | 4.4 | 2024-04-02 | Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity with Samsung Data Sto… |
CVE-2024-20850 | Medium | 6.2 | 2024-04-02 | Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of Samsung Pay. |
CVE-2024-20849 | High | 7.3 | 2024-04-02 | Out-of-bound Write vulnerability in chunk parsing implementation of libsdffextractor prior to SMR Apr-2023 Release 1 allows local attackers to execute arbitrar… |
CVE-2024-20848 | Medium | 4.0 | 2024-04-02 | Improper Input Validation vulnerability in text parsing implementation of libsdffextractor prior to SMR Apr-2024 Release 1 allows local attackers to write out-… |
CVE-2024-20847 | Medium | 4.0 | 2024-04-02 | Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard information. |
CVE-2024-20846 | Medium | 5.9 | 2024-04-02 | Out-of-bounds write vulnerability while decoding hcr of libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20845 | High | 8.4 | 2024-04-02 | Out-of-bounds write vulnerability while releasing memory in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20844 | High | 8.4 | 2024-04-02 | Out-of-bounds write vulnerability while parsing remaining codewords in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary… |
CVE-2024-20843 | Medium | 5.6 | 2024-04-02 | Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-2024 Release 1 allows local privileged attackers to execute ar… |
CVE-2024-20842 | Medium | 4.2 | 2024-04-02 | Improper Input Validation vulnerability in handling apdu of libsec-ril prior to SMR Apr-2024 Release 1 allows local privileged attackers to write out-of-bounds… |
CVE-2024-3148 | Medium | 6.3 | 2024-04-02 | A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_arch… |
CVE-2024-3147 | Medium | 4.3 | 2024-04-02 | A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipul… |
CVE-2024-3146 | Medium | 4.3 | 2024-04-02 | A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipu… |
CVE-2024-3145 | Medium | 4.3 | 2024-04-02 | A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtml… |
CVE-2024-3144 | Medium | 4.3 | 2024-04-02 | A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede… |
CVE-2024-3143 | Medium | 4.3 | 2024-04-02 | A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The man… |