CVE-2024-26xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
790 records · Page 6 of 8
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operati
Updated- CVE-2024-26303: Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon 4.9 Medium
Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon
Updated A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
UpdatedA vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
UpdatedA vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
UpdatedA vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
UpdatedVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
UpdatedVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
UpdatedVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
UpdatedVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
UpdatedVulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
UpdatedThe Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
UpdatedAn authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
UpdatedAn Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid N
UpdatedImproper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS E-series: before 2024.6.0; Avid NEXIS F-series: before 2024.6.0; Avid NEXIS PRO+: before 2024.6.0; Syste
UpdatedDeserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
UpdatedAn unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordUtilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123.
UpdatedAn attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
UpdatedUsing an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
UpdatedUpon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.
Updated- CVE-2024-26280: Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs) 4.7 Medium
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log per
Updated The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
UpdatedThe Custom Fields component not correctly filter inputs, leading to a XSS vector.
UpdatedA vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected ap
UpdatedA vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected ap
UpdatedA vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected ap
UpdatedCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perfor
UpdatedCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other
UpdatedCross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) an
UpdatedThe Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
UpdatedCross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.
UpdatedUser enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.
UpdatedIn Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities t
UpdatedMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the
UpdatedThe Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by mo
UpdatedEBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
UpdatedEBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.
UpdatedEBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to admi
UpdatedThe functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
Updated- CVE-2024-26260: Hgiga OAKlouds - Command Injection 9.8 Critical
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
Updated OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product.
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedLibarchive Remote Code Execution Vulnerability
Updated- CVE-2024-26255: Windows Remote Access Connection Manager Information Disclosure Vulnerability 5.5 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated Microsoft Virtual Machine Bus (VMBus) Denial of Service Vulnerability
UpdatedWindows rndismp6.sys Remote Code Execution Vulnerability
UpdatedWindows rndismp6.sys Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
UpdatedSecure Boot Security Feature Bypass Vulnerability
UpdatedWindows Kerberos Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability
UpdatedWindows SMB Elevation of Privilege Vulnerability
Updated- CVE-2024-26244: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Windows USB Print Driver Elevation of Privilege Vulnerability
UpdatedWindows Telephony Server Elevation of Privilege Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedSecure Boot Security Feature Bypass Vulnerability
UpdatedWindows Telephony Server Elevation of Privilege Vulnerability
Updated- CVE-2024-26238: Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability 7.8 High
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
Updated Windows Defender Credential Guard Elevation of Privilege Vulnerability
UpdatedWindows Update Stack Elevation of Privilege Vulnerability
UpdatedWindows Update Stack Elevation of Privilege Vulnerability
UpdatedProxy Driver Spoofing Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedWindows Telephony Server Elevation of Privilege Vulnerability
UpdatedWindows CSC Service Elevation of Privilege Vulnerability
UpdatedWindows Cryptographic Services Security Feature Bypass Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
Updated- CVE-2024-26226: Windows Distributed File System (DFS) Information Disclosure Vulnerability 6.5 Medium
Windows Distributed File System (DFS) Information Disclosure Vulnerability
Updated Windows DNS Server Remote Code Execution Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedWindows DNS Server Remote Code Execution Vulnerability
UpdatedWindows Mobile Hotspot Information Disclosure Vulnerability
UpdatedHTTP.sys Denial of Service Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
Updated- CVE-2024-26217: Windows Remote Access Connection Manager Information Disclosure Vulnerability 5.5 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated - CVE-2024-26216: Windows File Server Resource Management Service Elevation of Privilege Vulnerability 7.3 High
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Updated DHCP Server Service Denial of Service Vulnerability
UpdatedMicrosoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability
UpdatedMicrosoft Brokering File System Elevation of Privilege Vulnerability
UpdatedDHCP Server Service Denial of Service Vulnerability
Updated- CVE-2024-26211: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability 7.8 High
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Updated - CVE-2024-26210: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
UpdatedMicrosoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Updated- CVE-2024-26207: Windows Remote Access Connection Manager Information Disclosure Vulnerability 5.5 Medium
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Updated - CVE-2024-26205: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Updated Outlook for Android Information Disclosure Vulnerability
UpdatedAzure Data Studio Elevation of Privilege Vulnerability
UpdatedDHCP Server Service Remote Code Execution Vulnerability
UpdatedMicrosoft Intune Linux Agent Elevation of Privilege Vulnerability
Updated- CVE-2024-26200: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Updated Microsoft Office Elevation of Privilege Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
Updated