2024 CVEs (page 344)
Page 344 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26065 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26064 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker t… |
CVE-2024-26063 | Medium | 5.3 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An a… |
CVE-2024-26062 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26061 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26059 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26056 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26052 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26051 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26050 | Medium | 4.8 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacke… |
CVE-2024-26045 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26044 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker t… |
CVE-2024-26043 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26042 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker t… |
CVE-2024-26041 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26040 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26038 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26035 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26034 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26033 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26032 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker t… |
CVE-2024-26031 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26030 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26028 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-21652 | Critical | 9.8 | 2024-03-18 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulne… |
CVE-2024-20768 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20764 | Medium | 5.5 | 2024-03-18 | Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2024-20763 | Medium | 5.5 | 2024-03-18 | Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2024-20762 | Medium | 5.5 | 2024-03-18 | Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker co… |
CVE-2024-20761 | High | 7.8 | 2024-03-18 | Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2024-20760 | Medium | 5.4 | 2024-03-18 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20754 | High | 7.8 | 2024-03-18 | Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the contex… |
CVE-2024-28054 | High | 7.4 | 2024-03-18 | Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) whe… |
CVE-2024-27914 | Medium | 5.3 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated… |
CVE-2024-27104 | Medium | 4.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights… |
CVE-2024-27098 | Medium | 6.4 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-27096 | High | 7.7 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-2390 | High | 7.8 | 2024-03-18 | As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a mali… |
CVE-2024-2229 | High | 7.8 | 2024-03-18 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the applic… |
CVE-2024-2052 | High | 7.5 | 2024-03-18 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltration and download of… |
CVE-2024-2051 | Critical | 9.8 | 2024-03-18 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the syste… |
CVE-2024-2050 | High | 8.2 | 2024-03-18 | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects then executes arbit… |
CVE-2024-27937 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-27930 | Medium | 6.5 | 2024-03-18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated u… |
CVE-2024-20757 | Medium | 5.5 | 2024-03-18 | Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker c… |
CVE-2024-20756 | High | 7.8 | 2024-03-18 | Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2024-20755 | High | 7.8 | 2024-03-18 | Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20752 | High | 7.8 | 2024-03-18 | Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the c… |
CVE-2024-1658 | Medium | 5.4 | 2024-03-18 | The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-1333 | Medium | 5.4 | 2024-03-18 | The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a pag… |
CVE-2024-1331 | Medium | 6.1 | 2024-03-18 | The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2024-22257 | High | 8.2 | 2024-03-18 | In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior… |
CVE-2024-20746 | High | 7.8 | 2024-03-18 | Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the contex… |
CVE-2024-20745 | High | 7.8 | 2024-03-18 | Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2024-1753 | High | 8.6 | 2024-03-18 | A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers… |
CVE-2024-2599 | Critical | 9.9 | 2024-03-18 | File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through we… |
CVE-2024-2598 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2597 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2596 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2595 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2594 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2593 | High | 7.1 | 2024-03-18 | Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through… |
CVE-2024-2592 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/pic_show.php, in the 'person_id' parameter. This vulnerability… |
CVE-2024-2591 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerabi… |
CVE-2024-2590 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/select_send.php, in the 'sd_index' parameter. This vulnerabi… |
CVE-2024-2589 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_school_person.php, in multiple parameters. This v… |
CVE-2024-2588 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/admin/index.php, in the 'id' parameter. This vulnerability could allow a remot… |
CVE-2024-2587 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_khet_person.php, in multiple parameters. This vul… |
CVE-2024-2586 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remot… |
CVE-2024-2585 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send_2.php, in the 'sd_index' parameter. This vulnera… |
CVE-2024-2584 | High | 8.2 | 2024-03-18 | Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send.php, in the 'sd_index' parameter. This vulnerabi… |
CVE-2024-28547 | Medium | 6.5 | 2024-03-18 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the firewallEn parameter of formSetFirewallCfg function. |
CVE-2024-28537 | Critical | 9.8 | 2024-03-18 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function. |
CVE-2024-27774 | High | 7.5 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside D… |
CVE-2024-27773 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE |
CVE-2024-27772 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE |
CVE-2024-27771 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE |
CVE-2024-27770 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal |
CVE-2024-27769 | High | 8.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership… |
CVE-2024-27768 | Critical | 9.8 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE |
CVE-2024-27767 | Critical | 10.0 | 2024-03-18 | CWE-287: Improper Authentication may allow Authentication Bypass |
CVE-2024-2496 | Medium | 5.0 | 2024-03-18 | A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while… |
CVE-2024-2002 | High | 7.5 | 2024-03-18 | A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially cau… |
CVE-2024-28550 | Medium | 4.3 | 2024-03-18 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the filePath parameter of formExpandDlnaFile function. |
CVE-2024-20767 | High | 7.4 | 2024-03-18 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An at… |
CVE-2024-26641 | High | 8.6 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv(… |
CVE-2024-26640 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially al… |
CVE-2024-26638 | Medium | 4.4 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq va… |
CVE-2024-26637 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: rely on mac80211 debugfs handling for vif mac80211 started to delete debugf… |
CVE-2024-26636 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes syzbot was able to trick l… |
CVE-2024-26635 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc… |
CVE-2024-26634 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG() when a net n… |
CVE-2024-26633 | Medium | 5.5 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed o… |
CVE-2024-26632 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: block: Fix iterating over an empty bio with bio_for_each_folio_all If the bio contains no… |
CVE-2024-26631 | High | 7.8 | 2024-03-18 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work idev->mc_ifc_count can be writt… |
CVE-2024-1013 | High | 7.8 | 2024-03-18 | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnot… |
CVE-2024-1606 | Medium | 4.6 | 2024-03-18 | Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML… |
CVE-2024-1605 | Medium | 6.6 | 2024-03-18 | BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all… |
CVE-2024-1604 | Medium | 6.4 | 2024-03-18 | Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unautho… |
CVE-2024-28039 | Medium | 5.8 | 2024-03-18 | Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain… |