Archive
13 May 2024
Vulnerabilities first published on this day (UTC), newest first.
138 results · Feed
-
Critical 9.8
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Mo…
-
High 7.4
This issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
-
High 8.1
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
Medium 6.2
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.…
-
Medium 5.3
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, t…
-
Critical 9.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14…
-
High 7.5CVE-2024-27821 Public exploit
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS So…
-
High 7.7
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A …
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macO…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5…
-
Medium 5.3
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 1…
-
High 7.4CVE-2024-27822 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to…
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 an…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and i…
-
Low 2.4
This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacke…
-
Medium 5.5CVE-2024-27834 Exploited
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.…
KEV Nov 4, 2026 -
High 8.1
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute a…
-
Low 2.4
A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacke…
-
High 8.1CVE-2024-27804 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14…
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14…
-
Medium 5.5
A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to…
-
Medium 5.5
A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in…
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may …
-
Medium 5.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute a…
-
High 7.8
An authorization issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.5, macO…
-
High 7.8
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This iss…
-
Medium 5.5
Rhosp-director: cleartext passwords exposed in logs
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
-
High 7.1
HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
-
Critical 9.8
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
-
Medium 6.1
Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=.
-
Medium 4.8
Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute …
-
High 7.3
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=.
-
Medium 6.1
In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling…
-
Medium 5.4
Directus Lacks Session Tokens Invalidation
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie…
-
High 7.8CVE-2024-22774 Public exploit
An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges …
-
Medium 4.9
Directus allows redacted data extraction on the API through "alias"
Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redac…
-
High 7.8
An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execut…
-
Critical 9.8
TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the func…
-
High 8.8
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
-
High 7.5
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these se…