Total
322 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-3292 | 2024-05-17 | N/A | 8.2 HIGH | ||
| A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292 | |||||
| CVE-2024-3290 | 2024-05-17 | N/A | 8.2 HIGH | ||
| A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host | |||||
| CVE-2024-28137 | 2024-05-14 | N/A | 7.8 HIGH | ||
| A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. | |||||
| CVE-2024-2913 | 2024-05-07 | N/A | 6.5 MEDIUM | ||
| A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend. | |||||
| CVE-2023-33119 | 2024-05-06 | N/A | 8.4 HIGH | ||
| Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache. | |||||
| CVE-2023-32156 | 2024-05-03 | N/A | 9.0 CRITICAL | ||
| Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from improper error-handling during the update process. An attacker can leverage this vulnerability to execute code in the context of Tesla's Gateway ECU. Was ZDI-CAN-20734. | |||||
| CVE-2023-27323 | 2024-05-03 | N/A | 7.8 HIGH | ||
| Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-18150. | |||||
| CVE-2023-27327 | 2024-05-03 | N/A | 7.5 HIGH | ||
| Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18964. | |||||
| CVE-2024-23463 | 2024-04-30 | N/A | 8.8 HIGH | ||
| Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1 | |||||
| CVE-2024-29062 | 1 Microsoft | 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more | 2024-04-26 | N/A | 7.1 HIGH |
| Secure Boot Security Feature Bypass Vulnerability | |||||
| CVE-2024-32482 | 2024-04-24 | N/A | 2.2 LOW | ||
| The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available. | |||||
| CVE-2024-2440 | 2024-04-19 | N/A | 5.5 MEDIUM | ||
| A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. | |||||
| CVE-2024-1729 | 2024-04-16 | N/A | 5.9 MEDIUM | ||
| A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access. | |||||
| CVE-2023-28576 | 1 Qualcomm | 62 Fastconnect 6800, Fastconnect 6800 Firmware, Fastconnect 6900 and 59 more | 2024-04-12 | N/A | 7.0 HIGH |
| The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues. | |||||
| CVE-2022-33270 | 1 Qualcomm | 84 Ar8035, Ar8035 Firmware, Qca6391 and 81 more | 2024-04-12 | N/A | 5.9 MEDIUM |
| Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message. | |||||
| CVE-2022-33257 | 1 Qualcomm | 280 Aqt1000, Aqt1000 Firmware, Ar8031 and 277 more | 2024-04-12 | N/A | 7.0 HIGH |
| Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone. | |||||
| CVE-2023-33046 | 1 Qualcomm | 98 Ar8035, Ar8035 Firmware, Fastconnect 6900 and 95 more | 2024-04-12 | N/A | 7.0 HIGH |
| Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation. | |||||
| CVE-2022-48618 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2024-04-11 | N/A | 7.0 HIGH |
| The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1. | |||||
| CVE-2024-26218 | 2024-04-10 | N/A | 7.8 HIGH | ||
| Windows Kernel Elevation of Privilege Vulnerability | |||||
| CVE-2024-29066 | 2024-04-10 | N/A | 7.2 HIGH | ||
| Windows Distributed File System (DFS) Remote Code Execution Vulnerability | |||||