Total
286780 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-40815 | 1 Apple | 6 Ipad Os, Ipados, Iphone Os and 3 more | 2025-03-13 | 7.5 High |
| A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, macOS Sonoma 14.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. | ||||
| CVE-2024-40787 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2025-03-13 | 7.1 High |
| This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, macOS Sonoma 14.6. A shortcut may be able to bypass Internet permission requirements. | ||||
| CVE-2024-37370 | 2 Mit, Redhat | 8 Kerberos 5, Enterprise Linux, Rhel Aus and 5 more | 2025-03-13 | 7.5 High |
| In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application. | ||||
| CVE-2024-36540 | 1 External-secrets | 1 External-secrets | 2025-03-13 | 9.8 Critical |
| Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. | ||||
| CVE-2024-33222 | 1 Asus | 1 Atszio Driver | 2025-03-13 | 8.4 High |
| An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. | ||||
| CVE-2024-32904 | 1 Google | 1 Android | 2025-03-13 | 4.7 Medium |
| In ProtocolVsimOperationAdapter() of protocolvsimadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation. | ||||
| CVE-2024-2629 | 2 Fedoraproject, Google | 2 Fedora, Chrome | 2025-03-13 | 4.3 Medium |
| Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2024-27873 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2025-03-13 | 5.5 Medium |
| An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Processing a maliciously crafted video file may lead to unexpected app termination. | ||||
| CVE-2024-27830 | 1 Apple | 7 Ipados, Iphone Os, Macos and 4 more | 2025-03-13 | 6.5 Medium |
| This issue was addressed through improved state management. This issue is fixed in tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A maliciously crafted webpage may be able to fingerprint the user. | ||||
| CVE-2024-27530 | 1 Wasm3 Project | 1 Wasm3 | 2025-03-13 | 8.4 High |
| wasm3 139076a contains a Use-After-Free in ForEachModule. | ||||
| CVE-2024-27381 | 1 Samsung | 10 Exynos 1280, Exynos 1280 Firmware, Exynos 1330 and 7 more | 2025-03-13 | 6 Medium |
| An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_ut(), there is no input validation check on len coming from userspace, which can lead to a heap over-read. | ||||
| CVE-2024-25527 | 1 Ruvar | 1 Ruvaroa | 2025-03-13 | 9.4 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. | ||||
| CVE-2024-25428 | 1 Mrcms | 1 Mrcms | 2025-03-13 | 6.5 Medium |
| SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. | ||||
| CVE-2024-25216 | 1 Sherlock | 1 Employee Management System | 2025-03-13 | 9.8 Critical |
| Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php. | ||||
| CVE-2024-23766 | 1 Hms-networks | 1 Anybus X-gateway Ab7832-f3 | 2025-03-13 | 7.5 High |
| An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can use this feature to carry out a denial of service attack by continuously sending GET requests to that URL. | ||||
| CVE-2024-20102 | 2 Google, Mediatek | 9 Android, Mt3605, Mt6985 and 6 more | 2025-03-13 | 4.9 Medium |
| In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998892; Issue ID: MSV-1601. | ||||
| CVE-2024-20088 | 2 Google, Mediatek | 29 Android, Mt6765, Mt6768 and 26 more | 2025-03-13 | 4.4 Medium |
| In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932099; Issue ID: MSV-1543. | ||||
| CVE-2024-20081 | 5 Google, Linuxfoundation, Mediatek and 2 more | 39 Android, Yocto, Mt2735 and 36 more | 2025-03-13 | 9.8 Critical |
| In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08719602; Issue ID: MSV-1412. | ||||
| CVE-2024-20040 | 3 Google, Linux, Mediatek | 47 Android, Linux Kernel, Mt2713 and 44 more | 2025-03-13 | 8.8 High |
| In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979. | ||||
| CVE-2024-1330 | 1 Kadencewp | 1 Kadence Blocks Pro | 2025-03-13 | 4.3 Medium |
| The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database. | ||||