2024 CVEs (page 43)
Page 43 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45478 | Medium | 4.8 | 2025-01-21 | Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5… |
CVE-2024-24451 | High | 7.5 | 2025-01-21 | A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial… |
CVE-2024-24445 | Medium | 6.5 | 2025-01-21 | OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker wi… |
CVE-2024-24444 | High | 7.5 | 2025-01-21 | Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service… |
CVE-2024-24442 | High | 7.5 | 2025-01-21 | A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial… |
CVE-2024-57545 | Medium | 5.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (hidden_dhcp_num) is copied to the stack without lengt… |
CVE-2024-57544 | Medium | 5.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (lan_ipaddr) is copied to the stack without length ver… |
CVE-2024-57543 | Medium | 5.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (dhcpstart_ip) is copied to the stack without length v… |
CVE-2024-57542 | High | 8.8 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn. |
CVE-2024-57541 | Medium | 5.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (ipv6_protect_status) is copied to the stack without l… |
CVE-2024-57540 | Medium | 6.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack without length verific… |
CVE-2024-57539 | High | 8.2 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail. |
CVE-2024-57538 | Medium | 6.5 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copied to the stack with… |
CVE-2024-57537 | Medium | 6.3 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (page) is copied to the stack without length verificat… |
CVE-2024-57536 | High | 8.0 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status. |
CVE-2024-57360 | Medium | 5.5 | 2025-01-21 | https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-… |
CVE-2024-55959 | Critical | 9.1 | 2025-01-21 | Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions. |
CVE-2024-55958 | Medium | 4.8 | 2025-01-21 | Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6. |
CVE-2024-48392 | Medium | 5.4 | 2025-01-21 | OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validati… |
CVE-2024-21245 | Medium | 5.4 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected a… |
CVE-2024-42936 | Critical | 9.8 | 2025-01-21 | The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker mess… |
CVE-2024-55504 | Medium | 5.5 | 2025-01-21 | An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthori… |
CVE-2024-51417 | Medium | 6.4 | 2025-01-21 | An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. |
CVE-2024-54795 | Medium | 5.4 | 2025-01-21 | SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function. |
CVE-2024-54794 | Critical | 9.1 | 2025-01-21 | The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. |
CVE-2024-54792 | Medium | 6.1 | 2025-01-21 | A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another use… |
CVE-2024-45687 | | 2025-01-21 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Man… | |
CVE-2024-57036 | High | 8.1 | 2025-01-21 | TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an a… |
CVE-2024-56990 | Medium | 4.5 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php. |
CVE-2024-56998 | Medium | 4.2 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address. |
CVE-2024-56997 | Medium | 4.2 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter. |
CVE-2024-53829 | High | 8.2 | 2025-01-21 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an un… |
CVE-2024-56277 | Medium | 5.3 | 2025-01-21 | Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5. |
CVE-2024-51919 | Critical | 9.0 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designe… |
CVE-2024-51888 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login… |
CVE-2024-51818 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.Thi… |
CVE-2024-49700 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.Th… |
CVE-2024-49699 | High | 8.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-49688 | Critical | 9.8 | 2025-01-21 | Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4… |
CVE-2024-49666 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.Th… |
CVE-2024-49655 | Critical | 9.3 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.Th… |
CVE-2024-49333 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-49303 | High | 8.5 | 2025-01-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-49300 | High | 7.1 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugi… |
CVE-2024-32555 | Critical | 9.8 | 2025-01-21 | Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate… |
CVE-2024-57946 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-bl… |
CVE-2024-57945 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue of vmemmap address In sparse vmemmap model, the vir… |
CVE-2024-57944 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_init devm_kasprintf() can return a NULL p… |
CVE-2024-57943 | High | 7.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix the new buffer was not zeroed before writing Before writing, if a buffer_head… |
CVE-2024-57942 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At the end of netfs_unlock_read_folio() in w… |
CVE-2024-57941 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled When the cac… |
CVE-2024-57940 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a… |
CVE-2024-57939 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler… |
CVE-2024-57938 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default… |
CVE-2024-57936 | Critical | 9.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now. WQ… |
CVE-2024-57935 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to… |
CVE-2024-57934 | Medium | 4.7 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array[] In __ftrace_return_to_handler(), a… |
CVE-2024-57933 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling a… |
CVE-2024-57932 | Critical | 9.8 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exis… |
CVE-2024-57931 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore… |
CVE-2024-57930 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a T… |
CVE-2024-52973 | Medium | 6.5 | 2025-01-21 | An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This c… |
CVE-2024-43709 | Medium | 6.5 | 2025-01-21 | An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted… |
CVE-2024-37284 | Medium | 5.5 | 2025-01-21 | Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This… |
CVE-2024-13444 | Medium | 6.1 | 2025-01-21 | The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect no… |
CVE-2024-13230 | Medium | 5.3 | 2025-01-21 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializ… |
CVE-2024-11226 | Medium | 6.4 | 2025-01-21 | The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and includi… |
CVE-2024-6466 | Medium | 5.3 | 2025-01-21 | NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not… |
CVE-2024-13404 | Medium | 6.1 | 2025-01-21 | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2… |
CVE-2024-12104 | Medium | 5.3 | 2025-01-21 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capab… |
CVE-2024-12005 | Medium | 6.1 | 2025-01-21 | The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect… |
CVE-2024-10936 | High | 8.8 | 2025-01-21 | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted inpu… |
CVE-2024-13536 | Medium | 5.3 | 2025-01-21 | The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class… |
CVE-2024-45091 | Medium | 6.2 | 2025-01-21 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that coul… |
CVE-2024-13454 | Medium | 5.3 | 2025-01-20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenS… |
CVE-2024-22349 | Medium | 4.0 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2024-22348 | Medium | 5.3 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out… |
CVE-2024-22347 | Medium | 5.9 | 2025-01-20 | IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to d… |
CVE-2024-51738 | High | 8.1 | 2025-01-20 | Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and… |
CVE-2024-45647 | Medium | 5.6 | 2025-01-20 | IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the… |
CVE-2024-13176 | Medium | 4.1 | 2025-01-20 | Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A tim… |
CVE-2024-13524 | Medium | 4.5 | 2025-01-20 | A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-41783 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operati… |
CVE-2024-41743 | High | 7.5 | 2025-01-19 | IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of reso… |
CVE-2024-41742 | High | 7.5 | 2025-01-19 | IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By cond… |
CVE-2024-38337 | Critical | 9.1 | 2025-01-19 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive informat… |
CVE-2024-57929 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read… |
CVE-2024-57928 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecache() gets an error f… |
CVE-2024-57927 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: nfs: Fix oops in nfs_netfs_init_request() when copying to cache When netfslib wants to co… |
CVE-2024-57926 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err Th… |
CVE-2024-57925 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_all… |
CVE-2024-57924 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually p… |
CVE-2024-57923 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data le… |
CVE-2024-57922 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functi… |
CVE-2024-57921 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When running YouTube videos… |
CVE-2024-57919 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix divide error in DM plane scale calcs dm_get_plane_scale doesn't take… |
CVE-2024-57918 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using… |
CVE-2024-57917 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the follow… |
CVE-2024-57916 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling Resolve kernel p… |
CVE-2024-57914 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix NULL pointer issue on shared irq case The tcpci_irq() may meet bel… |