2024 CVEs (page 378)
Page 378 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0812 | High | 8.8 | 2024-01-24 | Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit object corruption via a… |
CVE-2024-0811 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2024-0810 | Medium | 4.3 | 2024-01-24 | Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2024-0809 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML p… |
CVE-2024-0808 | Critical | 9.8 | 2024-01-24 | Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chro… |
CVE-2024-0807 | High | 8.8 | 2024-01-24 | Use after free in Web Audio in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2024-0806 | High | 8.8 | 2024-01-24 | Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interactio… |
CVE-2024-0805 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain nam… |
CVE-2024-0804 | High | 7.5 | 2024-01-24 | Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2024-22497 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
CVE-2024-23636 | Critical | 9.8 | 2024-01-23 | SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a black… |
CVE-2024-23341 | Medium | 6.1 | 2024-01-23 | TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanes… |
CVE-2024-23330 | Medium | 5.3 | 2024-01-23 | Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the d… |
CVE-2024-22417 | Medium | 6.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `… |
CVE-2024-22205 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location`… |
CVE-2024-22204 | Medium | 5.3 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle a… |
CVE-2024-22203 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `s… |
CVE-2024-22496 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
CVE-2024-22490 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter. |
CVE-2024-22663 | Critical | 9.8 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg |
CVE-2024-22662 | Critical | 9.8 | 2024-01-23 | TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules |
CVE-2024-22660 | Critical | 9.8 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg |
CVE-2024-0755 | High | 8.8 | 2024-01-23 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-0754 | Medium | 6.5 | 2024-01-23 | Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. |
CVE-2024-0753 | Medium | 6.5 | 2024-01-23 | In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunder… |
CVE-2024-0752 | Medium | 6.5 | 2024-01-23 | A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable cr… |
CVE-2024-0751 | High | 8.8 | 2024-01-23 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 11… |
CVE-2024-0750 | High | 8.8 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2024-0749 | Medium | 4.3 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firef… |
CVE-2024-0748 | Medium | 4.3 | 2024-01-23 | A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. T… |
CVE-2024-0747 | Medium | 6.5 | 2024-01-23 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy… |
CVE-2024-0746 | Medium | 6.5 | 2024-01-23 | A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunde… |
CVE-2024-0745 | High | 8.8 | 2024-01-23 | The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability aff… |
CVE-2024-0744 | High | 7.5 | 2024-01-23 | In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects… |
CVE-2024-0743 | High | 7.5 | 2024-01-23 | An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115… |
CVE-2024-0742 | Medium | 4.3 | 2024-01-23 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent… |
CVE-2024-0741 | Medium | 6.5 | 2024-01-23 | An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox… |
CVE-2024-22705 | High | 7.8 | 2024-01-23 | An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-… |
CVE-2024-22076 | Critical | 9.8 | 2024-01-23 | MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administ… |
CVE-2024-0703 | Medium | 4.4 | 2024-01-23 | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and incl… |
CVE-2024-23348 | High | 8.8 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x s… |
CVE-2024-23183 | Medium | 5.4 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series… |
CVE-2024-23182 | High | 8.1 | 2024-01-23 | Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x ser… |
CVE-2024-23181 | Medium | 6.1 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series… |
CVE-2024-23180 | High | 8.8 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x s… |
CVE-2024-23851 | Medium | 5.5 | 2024-01-23 | copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_k… |
CVE-2024-23850 | Medium | 5.5 | 2024-01-23 | In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out… |
CVE-2024-23849 | Medium | 5.5 | 2024-01-23 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, res… |
CVE-2024-23848 | Medium | 5.5 | 2024-01-23 | In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-a… |
CVE-2024-0587 | Medium | 6.1 | 2024-01-23 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions… |
CVE-2024-23842 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22772 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22771 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22770 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22769 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22768 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-23224 | Medium | 5.5 | 2024-01-23 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app may be able to access sensitive user data. |
CVE-2024-23223 | Medium | 6.2 | 2024-01-23 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An… |
CVE-2024-23222 | High | 8.8 | 2024-01-23 | A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS… |
CVE-2024-23219 | Medium | 6.2 | 2024-01-23 | The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled. |
CVE-2024-23218 | Medium | 5.9 | 2024-01-23 | A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPad… |
CVE-2024-23217 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6… |
CVE-2024-23215 | Medium | 5.5 | 2024-01-23 | An issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3… |
CVE-2024-23214 | High | 8.8 | 2024-01-23 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3… |
CVE-2024-23213 | High | 8.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma… |
CVE-2024-23212 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, ma… |
CVE-2024-23211 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS… |
CVE-2024-23210 | Low | 3.3 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watch… |
CVE-2024-23209 | High | 8.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution. |
CVE-2024-23208 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may… |
CVE-2024-23207 | Medium | 5.5 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma… |
CVE-2024-23206 | Medium | 6.5 | 2024-01-23 | An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, ma… |
CVE-2024-23204 | High | 7.5 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7… |
CVE-2024-23203 | High | 7.5 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, m… |
CVE-2024-23345 | High | 7.1 | 2024-01-23 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2… |
CVE-2024-23342 | High | 7.4 | 2024-01-23 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorith… |
CVE-2024-23340 | Medium | 5.3 | 2024-01-22 | @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `ur… |
CVE-2024-23339 | Medium | 6.3 | 2024-01-22 | hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility… |
CVE-2024-23678 | High | 7.5 | 2024-01-22 | In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe dese… |
CVE-2024-23677 | Medium | 4.3 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file. |
CVE-2024-23676 | Medium | 4.6 | 2024-01-22 | In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to vie… |
CVE-2024-23675 | Medium | 6.5 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST applicati… |
CVE-2024-0606 | Medium | 6.1 | 2024-01-22 | An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions… |
CVE-2024-0605 | High | 7.5 | 2024-01-22 | Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security me… |
CVE-2024-0430 | Medium | 5.5 | 2024-01-22 | IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL code of the ImfHpRegFilter.sys driver. |
CVE-2024-0784 | Medium | 6.3 | 2024-01-22 | A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The mani… |
CVE-2024-0783 | Medium | 6.3 | 2024-01-22 | A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects some unknown processing of the file docu… |
CVE-2024-0204 | Critical | 9.8 | 2024-01-22 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. |
CVE-2024-0782 | Low | 3.5 | 2024-01-22 | A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2024-0781 | Low | 3.5 | 2024-01-22 | A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client… |
CVE-2024-0778 | High | 8.0 | 2024-01-22 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue… |
CVE-2024-22895 | High | 8.8 | 2024-01-22 | DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php. |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2024-0775 | Medium | 6.7 | 2024-01-22 | A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information lea… |
CVE-2024-22113 | Medium | 6.1 | 2024-01-22 | Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect us… |
CVE-2024-21484 | High | 7.5 | 2024-01-22 | Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can dec… |
CVE-2024-23771 | Critical | 9.8 | 2024-01-22 | darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi… |
CVE-2024-23770 | Medium | 5.5 | 2024-01-22 | darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. |
CVE-2024-23768 | High | 8.8 | 2024-01-22 | Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in these folders) can ac… |
CVE-2024-23752 | Critical | 9.8 | 2024-01-22 | GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that… |