CVE-Datenbank
Archiv bekannter Schwachstellen (CVEs) mit CVSS-Wert, Schweregrad, betroffenen Produkten und Herstellern. Nach Jahr und Schweregrad filterbar.
- CVE-2024-53104Hoch7.8
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
- CVE-2024-11667Hoch7.5
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
- CVE-2024-49035Hoch8.7
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
- CVE-2024-11680Kritisch9.8
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- CVE-2024-44309Mittel6.3
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- CVE-2024-44308Hoch8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- CVE-2024-50302Mittel5.5
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
- CVE-2024-21287Hoch7.5
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CVE-2024-9474Hoch7.2
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012Kritisch9.8
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-42392Mittel4.0
Eine Schwachstelle durch unsachgemäße Neutralisierung von Trennzeichen in Cesanta Mongoose Web Server v7.14 ermöglicht das Auslösen eines Fehlers mit einer Endlosschleife, wenn die Eingabezeichenfolge unerwartete Zeichen enthält.
- CVE-2024-42391Mittel4.3
Die Schwachstelle „Use of Out-of-range Pointer Offset“ in Cesanta Mongoose Web Server v7.14 ermöglicht es einem Angreifer, ein unerwartetes TLS-Paket zu senden und die Anwendung dazu zu zwingen, einen unbeabsichtigten Heap-Speicherbereich zu lesen.
- CVE-2024-42386Hoch8.2
Die Verwendung eines außerhalb des gültigen Bereichs liegenden Zeiger-Offsets in Cesanta Mongoose Web Server v7.14 ermöglicht es einem Angreifer, ein unerwartetes TLS-Paket zu senden und einen Segmentation Fault in der Anwendung zu verursachen.
- CVE-2024-42385Mittel4.0
Eine Schwachstelle durch unsachgemäße Neutralisierung von Begrenzungszeichen in Cesanta Mongoose Web Server v7.14 ermöglicht das Auslösen eines Out-of-Bounds-Speicherschreibvorgangs, wenn das PEM-Zertifikat unerwartete Zeichen enthält.
- CVE-2024-42384Hoch7.5
Eine Integer Overflow or Wraparound-Schwachstelle im Cesanta Mongoose Web Server v7.14 ermöglicht es einem Angreifer, ein unerwartetes TLS-Paket zu senden und einen Segmentation Fault in der Anwendung zu verursachen.
- CVE-2024-11182Mittel6.1
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
- CVE-2024-11120Kritisch9.8
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
- CVE-2024-43093Hoch7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- CVE-2024-8069Hoch8.0
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
- CVE-2024-8068Hoch8.0
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
This product uses the NVD API but is not endorsed or certified by the NVD.