2024 CVEs (page 365)
Page 365 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20947 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are aff… |
CVE-2024-20945 | Medium | 4.7 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20943 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2024-20941 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.13. E… |
CVE-2024-20939 | Medium | 4.3 | 2024-02-17 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Admin Console). Supported versions that are affected are 1… |
CVE-2024-20937 | Medium | 4.3 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2024-20935 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20933 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20931 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20929 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are… |
CVE-2024-20927 | High | 8.6 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20925 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20923 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20921 | Medium | 5.9 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20919 | Medium | 5.9 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20917 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Log Management). The supported version that is… |
CVE-2024-20915 | Medium | 5.3 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 1… |
CVE-2024-20913 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version tha… |
CVE-2024-20911 | Low | 2.6 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-20909 | High | 7.5 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Easily exploitable vulner… |
CVE-2024-20907 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are aff… |
CVE-2024-20905 | Low | 2.7 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affec… |
CVE-2024-20903 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.21 and 21.3-21.12. Easily exploitable vuln… |
CVE-2024-21984 | Medium | 5.9 | 2024-02-16 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting (XSS) vulnerabili… |
CVE-2024-21983 | Medium | 6.5 | 2024-02-16 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authe… |
CVE-2024-24758 | Low | 3.9 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Prox… |
CVE-2024-24750 | Medium | 6.5 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it… |
CVE-2024-25628 | High | 7.6 | 2024-02-16 | Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalida… |
CVE-2024-25627 | Low | 3.5 | 2024-02-16 | Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaS… |
CVE-2024-25083 | Medium | 6.3 | 2024-02-16 | An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector… |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |
CVE-2024-0023 | High | 7.8 | 2024-02-16 | In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalatio… |
CVE-2024-0021 | High | 7.8 | 2024-02-16 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due… |
CVE-2024-0020 | Medium | 5.5 | 2024-02-16 | In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. Th… |
CVE-2024-0019 | Medium | 5.0 | 2024-02-16 | In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check… |
CVE-2024-0018 | High | 7.8 | 2024-02-16 | In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalatio… |
CVE-2024-0017 | Medium | 5.5 | 2024-02-16 | In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosu… |
CVE-2024-0016 | Medium | 5.3 | 2024-02-16 | In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no ad… |
CVE-2024-21915 | Critical | 9.0 | 2024-02-16 | A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2024-0015 | High | 7.8 | 2024-02-16 | In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to… |
CVE-2024-23591 | Low | 2.0 | 2024-02-16 | ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privile… |
CVE-2024-25320 | Critical | 9.8 | 2024-02-16 | Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php. |
CVE-2024-21775 | High | 8.3 | 2024-02-16 | Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature. |
CVE-2024-22426 | High | 7.2 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially expl… |
CVE-2024-22425 | Medium | 6.5 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentia… |
CVE-2024-25466 | High | 7.8 | 2024-02-16 | Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a c… |
CVE-2024-24377 | Critical | 9.8 | 2024-02-16 | An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script. |
CVE-2024-22854 | Medium | 6.1 | 2024-02-16 | DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A… |
CVE-2024-25415 | High | 7.2 | 2024-02-16 | A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting… |
CVE-2024-25414 | Critical | 9.8 | 2024-02-16 | An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. |
CVE-2024-25413 | High | 7.2 | 2024-02-16 | A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary comm… |
CVE-2024-0041 | High | 7.0 | 2024-02-16 | In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local… |
CVE-2024-0040 | High | 7.5 | 2024-02-16 | In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with n… |
CVE-2024-0038 | High | 7.8 | 2024-02-16 | In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. Th… |
CVE-2024-0037 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could le… |
CVE-2024-0036 | High | 7.8 | 2024-02-16 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background… |
CVE-2024-0035 | High | 7.8 | 2024-02-16 | In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead t… |
CVE-2024-0034 | High | 7.8 | 2024-02-16 | In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local esca… |
CVE-2024-0033 | High | 7.8 | 2024-02-16 | In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with… |
CVE-2024-0032 | Medium | 6.5 | 2024-02-16 | In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to loca… |
CVE-2024-0031 | Critical | 9.8 | 2024-02-16 | In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote c… |
CVE-2024-0030 | Medium | 5.5 | 2024-02-16 | In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information dis… |
CVE-2024-0029 | High | 7.8 | 2024-02-16 | In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to l… |
CVE-2024-0014 | High | 7.8 | 2024-02-16 | In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation o… |
CVE-2024-23674 | Critical | 9.6 | 2024-02-15 | The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle at… |
CVE-2024-25123 | High | 7.3 | 2024-02-15 | MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulne… |
CVE-2024-23479 | Critical | 9.6 | 2024-02-15 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerabili… |
CVE-2024-23478 | High | 8.0 | 2024-02-15 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authent… |
CVE-2024-23477 | High | 7.9 | 2024-02-15 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnera… |
CVE-2024-23476 | Critical | 9.6 | 2024-02-15 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnera… |
CVE-2024-21728 | Medium | 6.1 | 2024-02-15 | An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted… |
CVE-2024-0622 | High | 8.8 | 2024-02-15 | Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The… |
CVE-2024-0240 | Medium | 6.5 | 2024-02-15 | A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this res… |
CVE-2024-25502 | Critical | 9.8 | 2024-02-15 | Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_bac… |
CVE-2024-25373 | Medium | 4.6 | 2024-02-15 | Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function. |
CVE-2024-23113 | Critical | 9.8 | 2024-02-15 | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7… |
CVE-2024-20720 | Critical | 9.1 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Comm… |
CVE-2024-20719 | Critical | 9.1 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an a… |
CVE-2024-20718 | Medium | 4.3 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Secur… |
CVE-2024-20717 | Medium | 5.4 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a lo… |
CVE-2024-20716 | Medium | 4.9 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an appli… |
CVE-2024-20750 | High | 7.8 | 2024-02-15 | Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea… |
CVE-2024-20749 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20748 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20747 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20739 | High | 7.8 | 2024-02-15 | Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2024-20738 | Critical | 9.8 | 2024-02-15 | Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature… |
CVE-2024-20736 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20735 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20734 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-20733 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application den… |
CVE-2024-20731 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-20730 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c… |
CVE-2024-20729 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-20728 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-20727 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-20726 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-1530 | Medium | 6.3 | 2024-02-15 | A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of the file /admin/view… |
CVE-2024-20744 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |