2024 CVEs (page 365)
Page 365 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0023 | High | 7.8 | 2024-02-16 | In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalatio… |
CVE-2024-0021 | High | 7.8 | 2024-02-16 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due… |
CVE-2024-0020 | Medium | 5.5 | 2024-02-16 | In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. Th… |
CVE-2024-0019 | Medium | 5.0 | 2024-02-16 | In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check… |
CVE-2024-0018 | High | 7.8 | 2024-02-16 | In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalatio… |
CVE-2024-0017 | Medium | 5.5 | 2024-02-16 | In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosu… |
CVE-2024-0016 | Medium | 5.3 | 2024-02-16 | In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no ad… |
CVE-2024-21915 | Critical | 9.0 | 2024-02-16 | A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2024-0015 | High | 7.8 | 2024-02-16 | In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to… |
CVE-2024-23591 | Low | 2.0 | 2024-02-16 | ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privile… |
CVE-2024-25320 | Critical | 9.8 | 2024-02-16 | Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php. |
CVE-2024-21775 | High | 8.3 | 2024-02-16 | Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature. |
CVE-2024-22426 | High | 7.2 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially expl… |
CVE-2024-22425 | Medium | 6.5 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentia… |
CVE-2024-25466 | High | 7.8 | 2024-02-16 | Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a c… |
CVE-2024-24377 | Critical | 9.8 | 2024-02-16 | An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script. |
CVE-2024-22854 | Medium | 6.1 | 2024-02-16 | DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A… |
CVE-2024-25415 | High | 7.2 | 2024-02-16 | A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting… |
CVE-2024-25414 | Critical | 9.8 | 2024-02-16 | An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. |
CVE-2024-25413 | High | 7.2 | 2024-02-16 | A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary comm… |
CVE-2024-0041 | High | 7.0 | 2024-02-16 | In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local… |
CVE-2024-0040 | High | 7.5 | 2024-02-16 | In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with n… |
CVE-2024-0038 | High | 7.8 | 2024-02-16 | In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. Th… |
CVE-2024-0037 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could le… |
CVE-2024-0036 | High | 7.8 | 2024-02-16 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background… |
CVE-2024-0035 | High | 7.8 | 2024-02-16 | In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead t… |
CVE-2024-0034 | High | 7.8 | 2024-02-16 | In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local esca… |
CVE-2024-0033 | High | 7.8 | 2024-02-16 | In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with… |
CVE-2024-0032 | Medium | 6.5 | 2024-02-16 | In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to loca… |
CVE-2024-0031 | Critical | 9.8 | 2024-02-16 | In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote c… |
CVE-2024-0030 | Medium | 5.5 | 2024-02-16 | In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information dis… |
CVE-2024-0029 | High | 7.8 | 2024-02-16 | In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to l… |
CVE-2024-0014 | High | 7.8 | 2024-02-16 | In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation o… |
CVE-2024-23674 | Critical | 9.6 | 2024-02-15 | The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle at… |
CVE-2024-25123 | High | 7.3 | 2024-02-15 | MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulne… |
CVE-2024-23479 | Critical | 9.6 | 2024-02-15 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerabili… |
CVE-2024-23478 | High | 8.0 | 2024-02-15 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authent… |
CVE-2024-23477 | High | 7.9 | 2024-02-15 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnera… |
CVE-2024-23476 | Critical | 9.6 | 2024-02-15 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnera… |
CVE-2024-21728 | Medium | 6.1 | 2024-02-15 | An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted… |
CVE-2024-0622 | High | 8.8 | 2024-02-15 | Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The… |
CVE-2024-0240 | Medium | 6.5 | 2024-02-15 | A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this res… |
CVE-2024-25502 | Critical | 9.8 | 2024-02-15 | Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_bac… |
CVE-2024-25373 | Medium | 4.6 | 2024-02-15 | Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function. |
CVE-2024-23113 | Critical | 9.8 | 2024-02-15 | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7… |
CVE-2024-20720 | Critical | 9.1 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Comm… |
CVE-2024-20719 | Critical | 9.1 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an a… |
CVE-2024-20718 | Medium | 4.3 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Secur… |
CVE-2024-20717 | Medium | 5.4 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a lo… |
CVE-2024-20716 | Medium | 4.9 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an appli… |
CVE-2024-20750 | High | 7.8 | 2024-02-15 | Substance3D - Designer versions 13.1.0 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea… |
CVE-2024-20749 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20748 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20747 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20739 | High | 7.8 | 2024-02-15 | Audition versions 24.0.3, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2024-20738 | Critical | 9.8 | 2024-02-15 | Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature… |
CVE-2024-20736 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20735 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2024-20734 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-20733 | Medium | 5.5 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an Improper Input Validation vulnerability that could lead to an application den… |
CVE-2024-20731 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-20730 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c… |
CVE-2024-20729 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-20728 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-20727 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-20726 | High | 7.8 | 2024-02-15 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-1530 | Medium | 6.3 | 2024-02-15 | A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of the file /admin/view… |
CVE-2024-20744 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20743 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20742 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read… |
CVE-2024-20741 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by a Write-what-where Condition vulnerability that could result in arbitrary code execution in th… |
CVE-2024-20740 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20725 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-20724 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-20723 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-20722 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-0390 | Critical | 9.8 | 2024-02-15 | INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation dev… |
CVE-2024-24386 | High | 7.2 | 2024-02-15 | An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. |
CVE-2024-24256 | Medium | 5.9 | 2024-02-15 | SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain sensitive informatio… |
CVE-2024-0353 | High | 7.8 | 2024-02-15 | Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission. |
CVE-2024-21727 | Medium | 6.1 | 2024-02-15 | XSS vulnerability in DP Calendar component for Joomla. |
CVE-2024-0708 | Medium | 5.3 | 2024-02-15 | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-25941 | Low | 3.3 | 2024-02-15 | The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside t… |
CVE-2024-25940 | Medium | 6.3 | 2024-02-15 | `bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any… |
CVE-2024-25559 | Medium | 4.7 | 2024-02-15 | URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may… |
CVE-2024-1488 | High | 8.0 | 2024-02-15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configu… |
CVE-2024-26264 | Critical | 9.8 | 2024-02-15 | EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allo… |
CVE-2024-26263 | Medium | 5.3 | 2024-02-15 | EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data with… |
CVE-2024-26262 | High | 8.8 | 2024-02-15 | EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular us… |
CVE-2024-26261 | Critical | 9.8 | 2024-02-15 | The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in… |
CVE-2024-26260 | Critical | 9.8 | 2024-02-15 | The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system… |
CVE-2024-1523 | High | 8.8 | 2024-02-15 | EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL co… |
CVE-2024-25620 | Medium | 6.4 | 2024-02-15 | Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whos… |
CVE-2024-24301 | High | 8.8 | 2024-02-14 | Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to… |
CVE-2024-24300 | Critical | 9.8 | 2024-02-14 | 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, th… |
CVE-2024-1471 | Medium | 5.9 | 2024-02-14 | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify R… |
CVE-2024-1367 | High | 7.2 | 2024-02-14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |