Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 136 of 521.
- GHSA-3fmq-x9q6-wm39 random_compat Uses insecure CSPRNG
- GHSA-3c5g-73f7-grvm Neos Information Disclosure Security Note
- GHSA-39j2-4p9j-5w4j Ez Platform Object Injection in legacy shop module
- GHSA-34q6-xqxh-gq39 Silverstripe XSS In rewritten hash links
- GHSA-346h-749j-r28w PHPECC vulnerable to multiple cryptographic side-channel attacks
- GHSA-337w-fxpq-5m34 Drupal core uses a vulnerable Third-party library CKEditor
- GHSA-32rx-xvvr-4xv9 easyadmin-extension-bundle action case insensitivity
- GHSA-2x7m-gf85-3745 Remote Denial of Service Vulnerability in Microsoft QUIC
- GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
- GHSA-2wq5-g96f-mv3v Segmentation fault due to use of uninitialized memory
- GHSA-2w9p-xxqr-h253 eZ Platform Object Injection in SiteAccessMatchListener
- GHSA-2vh3-cj9j-mcj5 eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template
- GHSA-2rxc-gjrp-vjhx Unsoundness in anstream
- GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login
- GHSA-2r6g-7r83-jg72 `spam` project on PyPI compromised, malicious releases made
- GHSA-2q97-m5rc-p3gp CosmWasm VM Incorrect metering
- GHSA-2p4f-vc9q-r5vp Typo3 Arbitrary file upload and XML External Entity processing
- GHSA-2m5g-8xpw-42vp OpenCFP Framework (Sentry) Account takeover via null password reset codes
- GHSA-2jx7-xg83-j2m7 Zendframework Denial of Service vector via XEE injection
- GHSA-2j6r-9vv4-6gf5 github.com/bincyber/go-sqlcrypter vulnerable to IV collision
- GHSA-2hpc-mf4q-j885 Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter
- GHSA-2gq2-m628-33xp gregwar/rst Local File Inclusion Vulnerability
- GHSA-2gh6-wc3m-g37f hermes-management is vulnerable to RCE due to Apache commons-jxpath
- GHSA-2g98-f9jv-w8c5 robrichards/xmlseclibs XPath injection
- GHSA-2fhr-8r8r-qp56 ZendFramework Information Disclosure and Insufficient Entropy vulnerability
- GHSA-2ffv-r4r9-r8xr Laravel RCE vulnerability in "cookie" session driver
- GHSA-2ff4-xfpr-m32r Impact <!-- _What kind of vulnerability is it?
- GHSA-2f46-4xjm-73x5 Passbolt API Stored XSS on first/last name during setup
- GHSA-29w6-c52g-m8jc C5 Firefly III CSV Injection.
- GHSA-29m4-mx89-3mjg TYPO3 Denial of Service in Online Media Asset Handling
- GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory
- GHSA-297g-xg4h-7w4c Laravel Cross-site Scripting vulnerability in blade templating
- GHSA-2867-6rrm-38gr Laravel Cookie serialization vulnerability
- GHSA-27qr-636m-wxg2 codeigniter/framework SQL injection in ODBC database driver
- GHSA-277h-px4m-62q8 @saltcorn/server arbitrary file zip read and download when downloading auto backups
- GHSA-26jh-r8g2-6fpr Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list
- GHSA-26hq-7286-mg8f Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
- GHSA-26hp-cgjj-m2j3 fuel/core ImageMagick driver does not escape all shell arguments.
- GHSA-265q-222x-52m6 silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector
- GHSA-25gq-jvx2-vg9x Silverstripe X-Forwarded-Host request hostname injection
- GHSA-259v-xm34-p7fr Typo3 Cross-Site Scripting in Language Pack Handling
- GHSA-259p-rvjx-ffwg .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.
- GHSA-2557-x9mg-76w8 ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` **Component**: C
- GHSA-23q2-5gf8-gjpp Enabling Authentication does not close all logged in socket connections immediately
- GHSA-23j4-mw76-5v7h Scrapy allows redirect following in protocols other than HTTP
- GHSA-22q7-cg4r-p9mx TYPO3 Cross-Site Scripting in Fluid ViewHelpers
- GHSA-229x-22xc-2f2w Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
- CVE-2024-9999 Multi-Factor Authentication Bypass in Progress WS_FTP Server
- CVE-2024-9997 Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution Vulnerability
- CVE-2024-9996 Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution Vulnerability
- CVE-2024-9994 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-9993 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-9991 Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices
- CVE-2024-9990 Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypass
- CVE-2024-9989 Crypto <= 2.18 - Authentication Bypass via log_in
- CVE-2024-9988 Crypto <= 2.19 - Authentication Bypass via register
- CVE-2024-9987 SQL Injection in CSV Module Data Collection
- CVE-2024-9986 code-projects Blood Bank Management System member_register.php sql injection
- CVE-2024-9985 Ragic Enterprise Cloud Database - Arbitrary File Upload
- CVE-2024-9984 Ragic Enterprise Cloud Database - Missing Authentication
- CVE-2024-9983 Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal
- CVE-2024-9982 ESi Technology AIM LINE Marketing Platform - SQL Injection
- CVE-2024-9981 FormosaSoft ee-class - Local File Inclusion
- CVE-2024-9980 FormosaSoft ee-class - SQL Injection
- CVE-2024-9979 Pyo3: risk of use-after-free in `borrowed` reads from python weak references
- CVE-2024-9978 Liteos_a has an out-of-bounds read vulnerability
- CVE-2024-9977 MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection
- CVE-2024-9976 code-projects Pharmacy Management System manage_customer.php sql injection
- CVE-2024-9975 SourceCodester Drag and Drop Image Upload upload.php unrestricted upload
- CVE-2024-9974 SourceCodester Online Eyewear Shop POST Request Master.php sql injection
- CVE-2024-9973 SourceCodester Online Eyewear Shop Report Viewing Page page sql injection
- CVE-2024-9972 ChanGate Property Management System - SQL Injection
- CVE-2024-9971 NewType FlowMaster BPM Plus - SQL Injection
- CVE-2024-9970 NewType FlowMaster BPM Plus - Privilege Escalation
- CVE-2024-9969 NewType WebEIP v3.0 - Reflected XSS
- CVE-2024-9968 NewType WebEIP v3.0 - SQL injection
- CVE-2024-9967 WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode
- CVE-2024-9966 Security feature bypass in Chrome
- CVE-2024-9965 Other in Chrome
- CVE-2024-9964 Other in Chrome
- CVE-2024-9963 Other in Chrome
- CVE-2024-9962 Other in Chrome
- CVE-2024-9961 Use after free in Chrome
- CVE-2024-9960 Use after free in Chrome
- CVE-2024-9959 Use after free in Chrome
- CVE-2024-9958 Other in Chrome
- CVE-2024-9957 Use after free in Chrome
- CVE-2024-9956 Privilege escalation in Chrome
- CVE-2024-9955 Use after free in Chrome
- CVE-2024-9954 Use after free in Chrome
- CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
- CVE-2024-9952 SourceCodester Online Eyewear Shop Contact Information Page contact_info cross site scripting
- CVE-2024-9951 Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
- CVE-2024-9950 Abuse of Unauthenticated Compliance Recheck in SecureConnector
- CVE-2024-9949 Denial of Service in Forescout SecureConnector
- CVE-2024-9947 ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-9946 Auth bypass in Social Share, Social Login and Social Comments Plugin – Super Socializer
- CVE-2024-9945 Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0
- CVE-2024-9944 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
- CVE-2024-9943 Cross-site request forgery in MultiVendorX – WooCommerce Multivendor Marketplace Solutions