Vulnerabilities (CVE)

Filtered by NVD-CWE-noinfo
Total 31938 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-50036 1 Linux 1 Linux Kernel 2024-11-17 N/A 7.0 HIGH
In the Linux kernel, the following vulnerability has been resolved: net: do not delay dst_entries_add() in dst_release() dst_entries_add() uses per-cpu data that might be freed at netns dismantle from ip6_route_net_exit() calling dst_entries_destroy() Before ip6_route_net_exit() can be called, we release all the dsts associated with this netns, via calls to dst_release(), which waits an rcu grace period before calling dst_destroy() dst_entries_add() use in dst_destroy() is racy, because dst_entries_destroy() could have been called already. Decrementing the number of dsts must happen sooner. Notes: 1) in CONFIG_XFRM case, dst_destroy() can call dst_release_immediate(child), this might also cause UAF if the child does not have DST_NOCOUNT set. IPSEC maintainers might take a look and see how to address this. 2) There is also discussion about removing this count of dst, which might happen in future kernels.
CVE-2024-45642 2 Ibm, Linux 2 Security Qradar Edr, Linux Kernel 2024-11-16 N/A 5.3 MEDIUM
IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-49027 1 Microsoft 4 365 Apps, Excel, Office and 1 more 2024-11-16 N/A 7.8 HIGH
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49026 1 Microsoft 5 365 Apps, Excel, Office and 2 more 2024-11-16 N/A 7.8 HIGH
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49030 1 Microsoft 4 365 Apps, Excel, Office and 1 more 2024-11-16 N/A 7.8 HIGH
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49029 1 Microsoft 4 365 Apps, Excel, Office and 1 more 2024-11-16 N/A 7.8 HIGH
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-49033 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2024-11-16 N/A 7.5 HIGH
Microsoft Word Security Feature Bypass Vulnerability
CVE-2024-49040 1 Microsoft 1 Exchange Server 2024-11-16 N/A 7.5 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2024-43620 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2024-11-15 N/A 8.8 HIGH
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2024-43621 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2024-11-15 N/A 8.8 HIGH
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2024-43622 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2024-11-15 N/A 8.8 HIGH
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2024-43623 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2024-11-15 N/A 7.8 HIGH
Windows NT OS Kernel Elevation of Privilege Vulnerability
CVE-2024-43625 1 Microsoft 6 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 3 more 2024-11-15 N/A 8.1 HIGH
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
CVE-2024-29119 1 Siemens 1 Spectrum Power 7 2024-11-15 N/A 7.8 HIGH
A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges.
CVE-2024-21949 1 Amd 1 Ryzen Ai Software 2024-11-15 N/A 5.5 MEDIUM
Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to system crash.
CVE-2024-21974 1 Amd 1 Ryzen Ai Software 2024-11-15 N/A 7.8 HIGH
Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.
CVE-2024-21975 1 Amd 1 Ryzen Ai Software 2024-11-15 N/A 7.8 HIGH
Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.
CVE-2024-47532 1 Zope 1 Restrictedpython 2024-11-15 N/A 6.5 MEDIUM
RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.
CVE-2024-49558 1 Dell 1 Smartfabric Os10 2024-11-15 N/A 7.8 HIGH
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2024-9539 1 Github 1 Enterprise Server 2024-11-15 N/A 4.3 MEDIUM
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click on that uploaded asset URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.2, 3.13.5, 3.12.10, 3.11.16. This vulnerability was reported via the GitHub Bug Bounty program.