Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 139 of 521.
- CVE-2024-9729 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9728 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9727 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9726 Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-9725 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9724 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9723 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9722 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9721 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9720 Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2024-9719 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9718 Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2024-9717 Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability
- CVE-2024-9716 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9715 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9714 Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9713 Trimble SketchUp Pro SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9712 Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-9711 EKC Tournament Manager < 2.2.2 - Delete Tournaments via CSRF
- CVE-2024-9710 PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF
- CVE-2024-9708 Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9707 Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
- CVE-2024-9706 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation
- CVE-2024-9705 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update
- CVE-2024-9704 Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9703 Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9702 Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9701 Remote Code Execution in kedro-org/kedro
- CVE-2024-9700 Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
- CVE-2024-9698 Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
- CVE-2024-9697 Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update
- CVE-2024-9696 Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-9694 CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-9693 Incorrect Authorization in GitLab
- CVE-2024-9692 Improper Access Control in Input in VIMESA VHF/FM Transmitter Blue Plus
- CVE-2024-9689 Post From Frontend <= 1.0.0 - Post Deletion via CSRF
- CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass
- CVE-2024-9686 Order Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message
- CVE-2024-9685 Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message
- CVE-2024-9684 Memory corruption in IEC-60870-5-104
- CVE-2024-9683 Quay: quay allows successful authentication with trucated version of the password
- CVE-2024-9682 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-9681 HSTS subdomain overwrites parent cache entry
- CVE-2024-9680 Mozilla Firefox Use-After-Free
- CVE-2024-9679 Hardcoded credentials in DLP Extension
- CVE-2024-9678 SQL injection in DLP Extension
- CVE-2024-9677 Information disclosure in USG FLEX H series uOS firmware
- CVE-2024-9676 Path traversal in OpenShift Developer Tools and Services
- CVE-2024-9675 Buildah: buildah allows arbitrary directory mount
- CVE-2024-9674 Cross-site scripting in Debrandify · Remove or Replace WordPress Branding
- CVE-2024-9672 Reflected XSS in PaperCut MF
- CVE-2024-9671 System: pdf invoices of the developer users can be seen if the url is known
- CVE-2024-9670 2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter
- CVE-2024-9669 File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion
- CVE-2024-9668 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-9667 Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter
- CVE-2024-9666 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability
- CVE-2024-9665 Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
- CVE-2024-9664 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File
- CVE-2024-9663 CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings
- CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings
- CVE-2024-9661 WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion
- CVE-2024-9660 School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload
- CVE-2024-9659 School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload
- CVE-2024-9658 School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation
- CVE-2024-9657 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-9656 Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9655 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
- CVE-2024-9653 Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting
- CVE-2024-9652 Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting
- CVE-2024-9651 Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS
- CVE-2024-9650 WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'
- CVE-2024-9649 WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion
- CVE-2024-9648 WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload
- CVE-2024-9647 Kama SpamBlock <= 1.8.2 - Reflected Cross-Site Scripting
- CVE-2024-9645 Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS
- CVE-2024-9644 Four-Faith F3x36 bapply.cgi Auth Bypass
- CVE-2024-9643 Four-Faith F3x36 Hidden Debug Credentials
- CVE-2024-9642 Editor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9641 LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS
- CVE-2024-9639 Authenticated Remote Code Execution
- CVE-2024-9638 Category Posts Widget < 4.9.18 - Admin+ Stored XSS
- CVE-2024-9637 Missing authorization in School Management System – WPSchoolPress
- CVE-2024-9636 Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
- CVE-2024-9635 Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scripting
- CVE-2024-9634 Deserialization in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-9633 Incorrect Ownership Assignment in GitLab
- CVE-2024-9632 Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
- CVE-2024-9631 Inefficient Algorithmic Complexity in GitLab
- CVE-2024-9630 WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure
- CVE-2024-9629 Missing authorization in Message Bridge for Contact Form 7 and Telegram
- CVE-2024-9628 WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API
- CVE-2024-9627 TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure
- CVE-2024-9626 Missing authorization in Editorial Assistant by Sovrn
- CVE-2024-9624 WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import
- CVE-2024-9623 Incorrect Authorization in GitLab
- CVE-2024-9622 HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4