2024 CVEs (page 355)
Page 355 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26333 | Medium | 5.5 | 2024-03-05 | swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib/modules/swfshape.c. |
CVE-2024-20833 | Medium | 4.1 | 2024-03-05 | Use after free vulnerability in pub_crypto_recv_msg prior to SMR Mar-2024 Release 1 due to race condition allows local attackers with system privilege to cause… |
CVE-2024-20841 | Medium | 5.1 | 2024-03-05 | Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data. |
CVE-2024-20840 | Medium | 5.7 | 2024-03-05 | Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers… |
CVE-2024-20839 | Medium | 4.6 | 2024-03-05 | Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers… |
CVE-2024-20838 | Medium | 6.8 | 2024-03-05 | Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code. |
CVE-2024-20837 | Medium | 5.3 | 2024-03-05 | Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to grant permission t… |
CVE-2024-20836 | Low | 3.3 | 2024-03-05 | Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out of bounds memory. |
CVE-2024-20835 | Medium | 4.0 | 2024-03-05 | Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local attackers to execute privileged behaviors. |
CVE-2024-20834 | Low | 3.3 | 2024-03-05 | The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address without proper permis… |
CVE-2024-20832 | Medium | 6.4 | 2024-03-05 | Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20831 | Medium | 6.4 | 2024-03-05 | Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20830 | Medium | 5.3 | 2024-03-05 | Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings. |
CVE-2024-20829 | Medium | 5.4 | 2024-03-05 | Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper in… |
CVE-2024-22383 | Medium | 6.2 | 2024-03-05 | Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover… |
CVE-2024-21838 | Medium | 6.8 | 2024-03-05 | Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injec… |
CVE-2024-21815 | Critical | 9.1 | 2024-03-05 | Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged… |
CVE-2024-22188 | High | 7.2 | 2024-03-05 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web… |
CVE-2024-1782 | Medium | 6.1 | 2024-03-05 | The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' parameter in all versions up to, and includi… |
CVE-2024-1769 | Medium | 5.3 | 2024-03-05 | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This ma… |
CVE-2024-1731 | High | 8.8 | 2024-03-05 | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrus… |
CVE-2024-1478 | Medium | 5.3 | 2024-03-05 | The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This ma… |
CVE-2024-1381 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-1285 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-1178 | Medium | 5.3 | 2024-03-05 | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1095 | Medium | 5.3 | 2024-03-05 | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch… |
CVE-2024-1093 | Medium | 5.3 | 2024-03-05 | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function… |
CVE-2024-1088 | Medium | 5.3 | 2024-03-05 | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-0825 | High | 8.8 | 2024-03-05 | The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 vi… |
CVE-2024-0698 | Medium | 6.4 | 2024-03-05 | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, an… |
CVE-2024-25269 | High | 7.5 | 2024-03-05 | libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. |
CVE-2024-27718 | High | 7.8 | 2024-03-05 | SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privi… |
CVE-2024-25731 | High | 7.5 | 2024-03-05 | The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus… |
CVE-2024-25164 | High | 7.5 | 2024-03-05 | iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality. |
CVE-2024-1936 | High | 7.5 | 2024-03-04 | The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Conse… |
CVE-2024-2168 | Medium | 4.7 | 2024-03-04 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-1319 | Medium | 4.3 | 2024-03-04 | The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post typ… |
CVE-2024-1316 | Medium | 6.5 | 2024-03-04 | The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the co… |
CVE-2024-2048 | High | 8.1 | 2024-03-04 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as tr… |
CVE-2024-27889 | High | 8.8 | 2024-03-04 | Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advance… |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-27694 | High | 7.4 | 2024-03-04 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit. |
CVE-2024-27680 | Medium | 6.1 | 2024-03-04 | Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form." |
CVE-2024-27668 | Medium | 6.1 | 2024-03-04 | Flusity-CMS v2.33 is affected by: Cross Site Scripting (XSS) in 'Custom Blocks.' |
CVE-2024-27684 | Medium | 6.1 | 2024-03-04 | A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attack… |
CVE-2024-24901 | Low | 3.0 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. A local malicious user with high privileges could potentially exploi… |
CVE-2024-22463 | High | 7.4 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could pot… |
CVE-2024-22452 | High | 7.3 | 2024-03-04 | Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potentially exploit th… |
CVE-2024-0156 | High | 7.0 | 2024-03-04 | Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability. A local low privileged attacker could potentially exploit this vulne… |
CVE-2024-0155 | High | 7.0 | 2024-03-04 | Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulner… |
CVE-2024-26622 | High | 7.8 | 2024-03-04 | In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates… |
CVE-2024-21826 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage. |
CVE-2024-21816 | Medium | 4.0 | 2024-03-04 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions. |
CVE-2024-20038 | Low | 3.4 | 2024-03-04 | In pq, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privilege… |
CVE-2024-20037 | Medium | 6.7 | 2024-03-04 | In pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2024-20036 | Medium | 4.4 | 2024-03-04 | In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges ne… |
CVE-2024-20034 | High | 7.2 | 2024-03-04 | In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2024-20033 | Medium | 4.4 | 2024-03-04 | In nvram, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2024-20032 | Medium | 6.7 | 2024-03-04 | In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20031 | Medium | 6.7 | 2024-03-04 | In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2024-20030 | Medium | 4.4 | 2024-03-04 | In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2024-20029 | High | 8.4 | 2024-03-04 | In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execut… |
CVE-2024-20028 | Medium | 6.6 | 2024-03-04 | In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2024-20027 | High | 7.9 | 2024-03-04 | In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20026 | Medium | 4.2 | 2024-03-04 | In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2024-20025 | Medium | 6.7 | 2024-03-04 | In da, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2024-20024 | Medium | 6.0 | 2024-03-04 | In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges… |
CVE-2024-20023 | Medium | 6.7 | 2024-03-04 | In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges… |
CVE-2024-20022 | Medium | 6.7 | 2024-03-04 | In lk, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20020 | Medium | 4.4 | 2024-03-04 | In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2024-20019 | Medium | 5.9 | 2024-03-04 | In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2024-20018 | Critical | 9.8 | 2024-03-04 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional e… |
CVE-2024-20017 | Critical | 9.8 | 2024-03-04 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional executio… |
CVE-2024-20005 | High | 8.2 | 2024-03-04 | In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-2156 | Medium | 6.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown function of the file adm… |
CVE-2024-2155 | Medium | 4.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-2154 | Medium | 6.3 | 2024-03-04 | A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-2153 | Medium | 6.3 | 2024-03-04 | A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /ad… |
CVE-2024-2152 | Medium | 4.7 | 2024-03-04 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown… |
CVE-2024-2151 | Medium | 4.3 | 2024-03-04 | A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown function… |
CVE-2024-28088 | High | 8.1 | 2024-03-04 | LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypa… |
CVE-2024-28084 | High | 7.5 | 2024-03-03 | p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact bec… |
CVE-2024-2150 | Medium | 5.3 | 2024-03-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing… |
CVE-2024-2149 | Medium | 4.7 | 2024-03-03 | A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.ph… |
CVE-2024-2148 | Medium | 6.3 | 2024-03-03 | A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/U… |
CVE-2024-2147 | High | 7.3 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2024-2146 | Low | 3.5 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been declared as problematic. Affected by this vulnerability is an unkno… |
CVE-2024-0765 | Medium | 6.5 | 2024-03-03 | As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that e… |
CVE-2024-2145 | Low | 3.5 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the f… |
CVE-2024-22355 | Medium | 5.9 | 2024-03-03 | IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong… |
CVE-2024-27255 | Medium | 5.9 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker t… |
CVE-2024-26469 | High | 8.1 | 2024-03-03 | Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remot… |
CVE-2024-25847 | Critical | 9.8 | 2024-03-03 | SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, al… |
CVE-2024-25842 | High | 7.5 | 2024-03-03 | An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0… |
CVE-2024-25839 | High | 7.5 | 2024-03-03 | An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate pri… |
CVE-2024-24302 | Critical | 9.8 | 2024-03-03 | An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute ar… |
CVE-2024-25844 | High | 7.5 | 2024-03-03 | An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate pr… |
CVE-2024-25551 | Medium | 6.1 | 2024-03-03 | Cross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code via crafted GET req… |
CVE-2024-24307 | High | 7.5 | 2024-03-03 | Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to esca… |