CVE-2024-23xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
818 records · Page 6 of 9
To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordTo maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
Updated · Rejected recordImproper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
UpdatedFusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.
Updatedmemory corruption when WiFi display APIs are invoked with large random inputs.
UpdatedTransient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.
UpdatedMemory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.
UpdatedMemory corruption when kernel driver attempts to trigger hardware fences.
UpdatedMemory corruption while processing graphics kernel driver request to create DMA fence.
UpdatedMemory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.
UpdatedMemory corruption while handling user packets during VBO bind operation.
Updated- CVE-2024-23379: Double Free in DSP Services 6.7 Medium
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
Updated - CVE-2024-23378: Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio 6.7 Medium
Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.
Updated Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.
UpdatedMemory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
Updated- CVE-2024-23375: Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in RIL 6.7 Medium
Memory corruption during the network scan request.
Updated Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
UpdatedMemory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
UpdatedMemory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.
UpdatedMemory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
Updated- CVE-2024-23369: Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS 7.8 High
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Updated Memory corruption when allocating and accessing an entry in an SMEM partition.
UpdatedInformation Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
UpdatedMemory corruption while releasing shared resources in MinkSocket listener thread.
UpdatedTransient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
UpdatedTransient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
UpdatedCryptographic issue while parsing RSA keys in COBR format.
UpdatedMemory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers.
UpdatedInformation disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
UpdatedTransient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
UpdatedTransient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Updated- CVE-2024-23356: Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS 7.8 High
Memory corruption during session sign renewal request calls in HLOS.
Updated Memory corruption when keymaster operation imports a shared key.
UpdatedMemory corruption when the IOCTL call is interrupted by a signal.
UpdatedTransient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Updated- CVE-2024-23352: Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor 7.5 High
Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.
Updated Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
UpdatedPermanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack. Users are recommended to upgrade to version [1.2.5], which fixes th
UpdatedImproper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file.
UpdatedPrior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.
UpdatedPymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version
UpdatedNautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via
UpdatedTuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Community Edition.
UpdatedThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.
UpdatedTuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi
Updated@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve
Updated- CVE-2024-23339: hoolock does not block Prototype pollution with object-path related utilities 6.3 Medium
hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access
Updated ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-53427. Reason: This candidate is a duplicate of CVE-2024-53427. Notes: All CVE users should reference CVE-2024-53427 instead of this candidate.
Updated · Rejected recordjq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
UpdatedMyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyB
UpdatedMyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability
Updated- CVE-2024-23334: aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal 5.9 Medium
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validati
Updated LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the file is then accessed via web the code would be executed. The issue is mitigated by the following:
UpdatedThe Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such a
UpdatedVite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive g
UpdatedTuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedd
Updatedchangedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to t
Updated- CVE-2024-23328: The Dataease datasource exists deserialization and arbitrary file read vulnerability 9.1 Critical
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized
Updated Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are adv
UpdatedEnvoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but
UpdatedEnvoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. It is valid for a client to present its IPv6 address to a target serve
UpdatedEnvoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known work
Updated- CVE-2024-23323: Excessive CPU usage when URI template matcher is configured using regex in Envoy 4.3 Medium
Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Updated Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the bac
UpdatedFor RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such
Updated- CVE-2024-23320: Apache DolphinScheduler: Arbitrary js execution as root for authenticated users 8.8 High
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.
Updated Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
UpdatedExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 p
UpdatedHTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.
UpdatedA read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger this vulnerability.
UpdatedWhen HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
UpdatedAn integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Updated