2024 CVEs (page 39)
Page 39 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34748 | High | 8.4 | 2025-01-28 | In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. This could lead to local escalation of pri… |
CVE-2024-34733 | High | 8.4 | 2025-01-28 | In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of pr… |
CVE-2024-34732 | High | 8.4 | 2025-01-28 | In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in… |
CVE-2024-13484 | High | 8.2 | 2025-01-28 | A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instan… |
CVE-2024-8401 | Medium | 5.4 | 2025-01-28 | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folde… |
CVE-2024-7881 | Medium | 5.1 | 2025-01-28 | An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an add… |
CVE-2024-6351 | Medium | 4.3 | 2025-01-28 | A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert |
CVE-2024-11956 | Medium | 4.7 | 2025-01-28 | A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functi… |
CVE-2024-11954 | Low | 2.4 | 2025-01-28 | A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Docum… |
CVE-2024-23953 | Medium | 6.5 | 2025-01-28 | Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte… |
CVE-2024-13527 | Medium | 6.4 | 2025-01-28 | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in a… |
CVE-2024-13521 | Medium | 6.1 | 2025-01-28 | The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missi… |
CVE-2024-13509 | High | 7.2 | 2025-01-28 | The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.1… |
CVE-2024-13448 | Critical | 9.8 | 2025-01-28 | The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' func… |
CVE-2024-12807 | Medium | 4.8 | 2025-01-28 | The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-12723 | Medium | 6.1 | 2025-01-28 | The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-11135 | High | 7.5 | 2025-01-28 | The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and in… |
CVE-2024-53881 | Medium | 5.5 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial… |
CVE-2024-53869 | Medium | 5.5 | 2025-01-28 | NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability m… |
CVE-2024-0150 | High | 7.1 | 2025-01-28 | NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful e… |
CVE-2024-0149 | Low | 3.3 | 2025-01-28 | NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerabi… |
CVE-2024-0147 | Medium | 5.5 | 2025-01-28 | NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data… |
CVE-2024-0146 | High | 7.8 | 2025-01-28 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this v… |
CVE-2024-0140 | Medium | 6.8 | 2025-01-28 | NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulne… |
CVE-2024-0137 | Medium | 5.5 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the hos… |
CVE-2024-0136 | High | 7.6 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and… |
CVE-2024-0135 | High | 7.6 | 2025-01-28 | NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A… |
CVE-2024-45341 | Medium | 6.1 | 2025-01-28 | A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certifica… |
CVE-2024-45340 | High | 8.8 | 2025-01-28 | Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not… |
CVE-2024-45339 | High | 7.1 | 2025-01-28 | When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a… |
CVE-2024-45336 | Medium | 6.1 | 2025-01-28 | The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is r… |
CVE-2024-22315 | Medium | 4.0 | 2025-01-28 | IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container t… |
CVE-2024-27263 | Medium | 5.3 | 2025-01-28 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dash… |
CVE-2024-12649 | Critical | 9.8 | 2025-01-28 | Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2024-12648 | Critical | 9.8 | 2025-01-28 | Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-12647 | Critical | 9.8 | 2025-01-28 | Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-28786 | Medium | 6.5 | 2025-01-28 | IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using… |
CVE-2024-57549 | High | 7.5 | 2025-01-27 | CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. |
CVE-2024-57548 | Critical | 9.1 | 2025-01-27 | CMSimple 5.16 allows the user to edit log.php file via print page. |
CVE-2024-57547 | High | 7.5 | 2025-01-27 | Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of dow… |
CVE-2024-57546 | High | 7.5 | 2025-01-27 | An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. |
CVE-2024-57373 | High | 8.1 | 2025-01-27 | Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of an authenticated u… |
CVE-2024-57052 | Critical | 9.8 | 2025-01-27 | An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. |
CVE-2024-56316 | High | 7.5 | 2025-01-27 | In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent De… |
CVE-2024-56178 | Medium | 6.5 | 2025-01-27 | An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin… |
CVE-2024-54728 | Medium | 6.5 | 2025-01-27 | Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. |
CVE-2024-48662 | Medium | 6.1 | 2025-01-27 | Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the… |
CVE-2024-54557 | High | 7.5 | 2025-01-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may g… |
CVE-2024-54550 | Medium | 4.0 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An app may be a… |
CVE-2024-54549 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensiti… |
CVE-2024-54547 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-54543 | High | 8.8 | 2025-01-27 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18… |
CVE-2024-54542 | Critical | 9.1 | 2025-01-27 | An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS… |
CVE-2024-54541 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ven… |
CVE-2024-54539 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be… |
CVE-2024-54537 | High | 8.2 | 2025-01-27 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may b… |
CVE-2024-54536 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.2. An app may be able to edit NVRAM variable… |
CVE-2024-54530 | Critical | 9.1 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, watchOS 11.2. Password autofil… |
CVE-2024-54523 | Medium | 6.3 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54522 | High | 7.8 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54520 | Medium | 5.5 | 2025-01-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may… |
CVE-2024-54519 | Medium | 5.5 | 2025-01-27 | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read sensitive location inf… |
CVE-2024-54518 | Medium | 5.3 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54517 | High | 7.8 | 2025-01-27 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may b… |
CVE-2024-54516 | Low | 3.3 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to approve a… |
CVE-2024-54512 | Critical | 9.1 | 2025-01-27 | The issue was addressed by removing the relevant flags. This issue is fixed in iOS 18.2 and iPadOS 18.2, watchOS 11.2. A system binary could be used to fingerp… |
CVE-2024-54509 | High | 7.8 | 2025-01-27 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Sonoma 14.7.3… |
CVE-2024-54507 | Medium | 5.5 | 2025-01-27 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. An attacker with user… |
CVE-2024-54499 | High | 8.8 | 2025-01-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS… |
CVE-2024-54497 | Medium | 6.5 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2, macOS Sonoma 14.7.3, macOS Ve… |
CVE-2024-54488 | Medium | 5.3 | 2025-01-27 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7… |
CVE-2024-54478 | Medium | 6.5 | 2025-01-27 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.4, macOS Sequoia 15.2… |
CVE-2024-54475 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventu… |
CVE-2024-54468 | High | 8.2 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ve… |
CVE-2024-44172 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.3, macOS Ventura… |
CVE-2024-37526 | Medium | 6.5 | 2025-01-27 | IBM Watson Query on Cloud Pak for Data (IBM Data Virtualization 1.8, 2.0, 2.1, 2.2, and 3.0.0) could allow an authenticated user to obtain sensitive informatio… |
CVE-2024-48841 | Critical | 10.0 | 2025-01-27 | Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older. |
CVE-2024-56972 | Medium | 6.5 | 2025-01-27 | An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56971 | Medium | 6.5 | 2025-01-27 | An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information vi… |
CVE-2024-56969 | Medium | 6.5 | 2025-01-27 | An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56968 | Medium | 6.5 | 2025-01-27 | An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. |
CVE-2024-56967 | Medium | 6.5 | 2025-01-27 | An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56966 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information… |
CVE-2024-56965 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted lin… |
CVE-2024-56964 | Medium | 6.5 | 2025-01-27 | An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplyin… |
CVE-2024-56963 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted… |
CVE-2024-56962 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56960 | Medium | 6.5 | 2025-01-27 | An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56959 | Medium | 6.5 | 2025-01-27 | An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56957 | Medium | 6.5 | 2025-01-27 | An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted l… |
CVE-2024-56955 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56954 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56953 | Medium | 6.5 | 2025-01-27 | An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. |
CVE-2024-56952 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a cr… |
CVE-2024-56951 | Medium | 6.5 | 2025-01-27 | An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56950 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56949 | Medium | 6.5 | 2025-01-27 | An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying… |
CVE-2024-56948 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56947 | Medium | 6.5 | 2025-01-27 | An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-26317 | Medium | 6.1 | 2025-01-27 | In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the alg… |