2024 CVEs (page 77)
Page 77 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49074 | High | 7.8 | 2024-12-12 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
CVE-2024-49073 | Medium | 6.8 | 2024-12-12 | Windows Mobile Broadband Driver Elevation of Privilege Vulnerability |
CVE-2024-49072 | High | 7.8 | 2024-12-12 | Windows Task Scheduler Elevation of Privilege Vulnerability |
CVE-2024-49070 | High | 7.4 | 2024-12-12 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2024-49069 | High | 7.8 | 2024-12-12 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2024-49068 | High | 8.2 | 2024-12-12 | Microsoft SharePoint Elevation of Privilege Vulnerability |
CVE-2024-49065 | Medium | 5.5 | 2024-12-12 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2024-49064 | Medium | 6.5 | 2024-12-12 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2024-49063 | High | 8.4 | 2024-12-12 | Microsoft/Muzic Remote Code Execution Vulnerability |
CVE-2024-49062 | Medium | 6.5 | 2024-12-12 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2024-49059 | High | 7.0 | 2024-12-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2024-49057 | High | 8.1 | 2024-12-12 | Microsoft Defender for Endpoint on Android Spoofing Vulnerability |
CVE-2024-47835 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc functi… |
CVE-2024-47834 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing… |
CVE-2024-47778 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gs… |
CVE-2024-47777 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk funct… |
CVE-2024-47776 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. Th… |
CVE-2024-47775 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavp… |
CVE-2024-47774 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_c… |
CVE-2024-47615 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet withi… |
CVE-2024-47613 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_de… |
CVE-2024-47607 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function… |
CVE-2024-47606 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extens… |
CVE-2024-47603 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_d… |
CVE-2024-47602 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_d… |
CVE-2024-47601 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_d… |
CVE-2024-47600 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in… |
CVE-2024-47599 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_n… |
CVE-2024-47598 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table fu… |
CVE-2024-47597 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux… |
CVE-2024-47596 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function withi… |
CVE-2024-47546 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtd… |
CVE-2024-47545 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdem… |
CVE-2024-47544 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vul… |
CVE-2024-47543 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function… |
CVE-2024-47542 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint functi… |
CVE-2024-47541 | High | 7.5 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_overrid… |
CVE-2024-47540 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matro… |
CVE-2024-47539 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a func… |
CVE-2024-47538 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_pac… |
CVE-2024-47537 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to acc… |
CVE-2024-45404 | High | 8.1 | 2024-12-12 | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attack… |
CVE-2024-45337 | Critical | 9.1 | 2024-12-12 | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorizatio… |
CVE-2024-43600 | High | 7.8 | 2024-12-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2024-43594 | High | 7.3 | 2024-12-12 | Microsoft System Center Elevation of Privilege Vulnerability |
CVE-2024-42448 | Critical | 9.9 | 2024-12-12 | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution… |
CVE-2024-37401 | High | 7.5 | 2024-12-12 | An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-37377 | High | 7.5 | 2024-12-12 | A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. |
CVE-2024-12489 | Medium | 6.3 | 2024-12-12 | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-12488 | Medium | 6.3 | 2024-12-12 | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown funct… |
CVE-2024-12487 | Medium | 6.3 | 2024-12-12 | A vulnerability has been found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an un… |
CVE-2024-12486 | Medium | 6.3 | 2024-12-12 | A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of t… |
CVE-2024-12485 | Medium | 6.3 | 2024-12-12 | A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown… |
CVE-2024-12484 | High | 7.3 | 2024-12-12 | A vulnerability classified as critical was found in Codezips Technical Discussion Forum 1.0. This vulnerability affects unknown code of the file /signuppost.ph… |
CVE-2024-12483 | Low | 3.7 | 2024-12-12 | A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User… |
CVE-2024-12482 | Medium | 4.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cm… |
CVE-2024-12481 | Medium | 6.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file… |
CVE-2024-12480 | Medium | 6.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been classified as critical. Affected is the function searchTopic of the file wetech-cms-maste… |
CVE-2024-12479 | Medium | 6.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function searchTopicByKeyword of the file wetech-cm… |
CVE-2024-12382 | High | 8.8 | 2024-12-12 | Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-12381 | High | 8.8 | 2024-12-12 | Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-11950 | High | 8.8 | 2024-12-12 | XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-11949 | High | 8.8 | 2024-12-12 | GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2024-11948 | Critical | 9.8 | 2024-12-12 | GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
CVE-2024-11947 | High | 8.8 | 2024-12-12 | GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-11872 | High | 7.8 | 2024-12-12 | Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2024-9845 | High | 7.8 | 2024-12-11 | Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privil… |
CVE-2024-8496 | High | 7.8 | 2024-12-11 | Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local… |
CVE-2024-48912 | High | 8.1 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application… |
CVE-2024-47761 | High | 7.2 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifi… |
CVE-2024-47760 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can tak… |
CVE-2024-11598 | High | 7.8 | 2024-12-11 | Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authentica… |
CVE-2024-11597 | High | 7.8 | 2024-12-11 | Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authentica… |
CVE-2024-10251 | High | 7.8 | 2024-12-11 | Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local p… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2024-47758 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take… |
CVE-2024-28141 | Medium | 6.3 | 2024-12-11 | The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the applicat… |
CVE-2024-28140 | Medium | 6.1 | 2024-12-11 | The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the roo… |
CVE-2024-28139 | High | 8.8 | 2024-12-11 | The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the… |
CVE-2024-50585 | Medium | 4.7 | 2024-12-11 | Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the conte… |
CVE-2024-51460 | Medium | 4.3 | 2024-12-11 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2024-11351 | Medium | 5.3 | 2024-12-11 | The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all… |
CVE-2024-12325 | Medium | 6.1 | 2024-12-11 | The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.4.1 due to… |
CVE-2024-12294 | Medium | 5.3 | 2024-12-11 | The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'g… |
CVE-2024-11840 | High | 7.1 | 2024-12-11 | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing c… |
CVE-2024-11008 | Medium | 5.3 | 2024-12-11 | The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3… |
CVE-2024-54269 | Medium | 4.3 | 2024-12-11 | Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects No… |
CVE-2024-12363 | High | 7.1 | 2024-12-11 | Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arb… |
CVE-2024-11737 | Critical | 9.8 | 2024-12-11 | CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when a… |
CVE-2024-11401 | | 2024-12-11 | Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks… | |
CVE-2024-12283 | Medium | 6.1 | 2024-12-11 | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to ins… |
CVE-2024-12004 | Medium | 6.1 | 2024-12-11 | The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due t… |
CVE-2024-10511 | Medium | 5.3 | 2024-12-11 | CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly reque… |
CVE-2024-53292 | High | 7.2 | 2024-12-11 | Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A local high privileged attacker could pot… |
CVE-2024-53290 | High | 8.4 | 2024-12-11 | Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated atta… |
CVE-2024-53289 | High | 7.8 | 2024-12-11 | Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentia… |
CVE-2024-52537 | Medium | 6.3 | 2024-12-11 | Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially… |
CVE-2024-11053 | Low | 3.4 | 2024-12-11 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to ho… |
CVE-2024-35117 | Medium | 4.4 | 2024-12-11 | IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtai… |
CVE-2024-55655 | | 2024-12-10 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insu… |