Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 137 of 521.
- CVE-2024-9942 WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload
- CVE-2024-9941 WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- CVE-2024-9940 Calculated Fields Form <= 5.2.45 - HTML Injection
- CVE-2024-9939 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
- CVE-2024-9938 Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scripting
- CVE-2024-9937 Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting
- CVE-2024-9936 Race condition in Firefox
- CVE-2024-9935 PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
- CVE-2024-9934 Wp-ImageZoom <= 1.1.0 - Reflected XSS
- CVE-2024-9933 WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check
- CVE-2024-9932 Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
- CVE-2024-9931 Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator
- CVE-2024-9930 Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass
- CVE-2024-9929 Information disclosure in NSD570 Teleprotection Equipment
- CVE-2024-9928 Auth bypass in NSD570 Teleprotection Equipment
- CVE-2024-9927 WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal
- CVE-2024-9926 Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
- CVE-2024-9925 SQL injection in QPLANT by TAI Smart Factory
- CVE-2024-9924 Hgiga OAKlouds - Arbitrary File Read And Delete
- CVE-2024-9923 TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal
- CVE-2024-9922 TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal
- CVE-2024-9921 TEAMPLUS TECHNOLOGY Team+ - SQL Injection
- CVE-2024-9920 Unrestricted File Upload and Execution in parisneo/lollms-webui
- CVE-2024-9919 Missing Authentication Check in parisneo/lollms-webui
- CVE-2024-9918 HuangDou UTCMS sql.php RunSql sql injection
- CVE-2024-9917 HuangDou UTCMS template_creat.php deserialization
- CVE-2024-9916 HuangDou UTCMS cli.php os command injection
- CVE-2024-9915 D-Link DIR-619L B1 formVirtualServ buffer overflow
- CVE-2024-9914 D-Link DIR-619L B1 formSetWizardSelectMode buffer overflow
- CVE-2024-9913 D-Link DIR-619L B1 formSetRoute buffer overflow
- CVE-2024-9912 D-Link DIR-619L B1 formSetQoS buffer overflow
- CVE-2024-9911 D-Link DIR-619L B1 formSetPortTr buffer overflow
- CVE-2024-9910 D-Link DIR-619L B1 formSetPassword buffer overflow
- CVE-2024-9909 D-Link DIR-619L B1 formSetMuti buffer overflow
- CVE-2024-9908 D-Link DIR-619L B1 formSetMACFilter buffer overflow
- CVE-2024-9907 QileCMS Verification Code Forget.php sendEmail password recovery
- CVE-2024-9906 SourceCodester Online Eyewear Shop cross site scripting
- CVE-2024-9905 SourceCodester Online Eyewear Shop sql injection
- CVE-2024-9904 07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload
- CVE-2024-9903 07FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload
- CVE-2024-9902 Ansible-core: ansible-core user may read/write unauthorized content
- CVE-2024-9900 Cross-Site Scripting (XSS) in mudler/localai
- CVE-2024-9898 Parallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode
- CVE-2024-9897 Cross-site scripting in StreamWeasels Twitch Integration
- CVE-2024-9896 Cross-site scripting in Forumax – AI Powered Advanced Community Forum Plugin
- CVE-2024-9895 Cross-site scripting in Smart Online Order for Clover
- CVE-2024-9894 code-projects Blood Bank System reset.php sql injection
- CVE-2024-9893 Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-9892 Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-9891 Missing authorization in MultiLine Files for Contact Form 7
- CVE-2024-9890 User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass
- CVE-2024-9889 ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure
- CVE-2024-9888 ElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-9887 Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection
- CVE-2024-9886 WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9884 T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9883 Pods < 3.2.7.1 - Admin+ Stored XSS
- CVE-2024-9882 Salon Booking System < 10.9.4 - Admin+ Stored XSS
- CVE-2024-9881 LearnPress < 4.2.7.2 - Admin+ Stored XSS
- CVE-2024-9879 Website File Changes < 2.1.1 - Authenticated SQL Injection
- CVE-2024-9878 Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-9877 Sensitive information submitted using GET method
- CVE-2024-9876 Application is vulnerable to Privilege escalation
- CVE-2024-9875 Privilege escalation in Okta Privileged Access Server Agent (SFTD)
- CVE-2024-9874 WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection
- CVE-2024-9873 Community by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-9872 Missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
- CVE-2024-9868 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-9867 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-9866 Cross-site scripting in Event Tickets with Ticket Scanner
- CVE-2024-9865 Cross-site scripting in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-9864 EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-9863 Privilege escalation in Miniorange OTP Verification with Firebase
- CVE-2024-9862 Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change
- CVE-2024-9861 Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass
- CVE-2024-9860 Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import
- CVE-2024-9859 Memory corruption in Chrome
- CVE-2024-9858 Insecure user permissions in Google Cloud Migrate to Containers for Windows
- CVE-2024-9856 07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scripting
- CVE-2024-9855 07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule_1 uploadFile unrestricted upload
- CVE-2024-9853 ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9852 Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32
- CVE-2024-9851 LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9850 SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9849 Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload
- CVE-2024-9848 Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9847 Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
- CVE-2024-9846 Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-9845 Privilege escalation in Automation
- CVE-2024-9844 Security feature bypass in Connect Secure
- CVE-2024-9843 Memory corruption in Secure Access Client
- CVE-2024-9842 Misconfiguration in Secure Access Client
- CVE-2024-9841 OpenText ArcSight Management Center and ArcSight Platform Stored XSS
- CVE-2024-9839 Uix Slideshow <= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-9838 Auto Affiliate Links < 6.4.7 - Admin+ SQL Injection
- CVE-2024-9837 AADMY – Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-9836 RSS Feed Widget < 3.0.0 - Contributor+ Stored XSS
- CVE-2024-9835 RSS Feed Widget < 3.0.1 - Reflected XSS