Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 144 of 521.
- CVE-2024-9188 Specially constructed queries cause cross platform scripting leaking administrator tokens
- CVE-2024-9187 Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion
- CVE-2024-9186 Automation By Autonami < 3.3.0 - Unauthenticated SQLi
- CVE-2024-9184 SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-9183 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS
- CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges
- CVE-2024-9178 XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9177 Themedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2024-9174 Stored HTML Injection in Hubshare social module
- CVE-2024-9173 GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9172 Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9170 Cross-site scripting in Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
- CVE-2024-9169 litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-9167 Privilege escalation in Velocity License Server
- CVE-2024-9166 OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver
- CVE-2024-9165 Cross-site scripting in Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
- CVE-2024-9164 Missing Authentication for Critical Function in GitLab
- CVE-2024-9163 User Interface (UI) Misrepresentation of Critical Information in GitLab
- CVE-2024-9162 All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection
- CVE-2024-9161 Missing authorization in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- CVE-2024-9160 Security Misconfiguration in Forge module PEADM
- CVE-2024-9159 Incorrect Authorization in gaizhenbiao/chuanhuchatgpt
- CVE-2024-9158 XSS
- CVE-2024-9157 Privilege Escalation Vulnerability in CxUIUSvc service
- CVE-2024-9156 TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parameters
- CVE-2024-9155 Insufficient Authorization On Unlinked Channel Files
- CVE-2024-9154 Authenticated Remote Code Execution
- CVE-2024-9150 Code Injection in Wyn Enterprise
- CVE-2024-9149 SQLi in Wind Media's E-Commerce Website Template
- CVE-2024-9148 Flowise Stored Cross-Site Scripting
- CVE-2024-9147 HTML Injection in Bna Informatics' PosPratik
- CVE-2024-9146 WordPress CSS JS Files plugin <= 1.5.0 - Directory Traversal to File Read vulnerability
- CVE-2024-9145 Local command injection in Wiz Code Visual Studio Code extension
- CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access
- CVE-2024-9142 Local File Inclusion (LFI) in Olgu Computer Systems' e-Belediye
- CVE-2024-9141 Cross-Site Scripting (XSS) vulnerability in Oct8ne
- CVE-2024-9140 Command injection in EDF-G1002-BP Series
- CVE-2024-9139 OS Command Injection in Restricted Command
- CVE-2024-9138 Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances
- CVE-2024-9137 Moxa Service Missing Authentication for Critical Function
- CVE-2024-9136 Missing authorization in EMUI
- CVE-2024-9135 Denial of service in EOS
- CVE-2024-9134 SQL injection in Arista Edge Threat Management
- CVE-2024-9133 A user with administrator privileges is able to retrieve authentication tokens
- CVE-2024-9132 The administrator is able to configure an insecure captive portal script
- CVE-2024-9131 A user with administrator privileges can perform command injection
- CVE-2024-9130 SQL injection in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-9129 Format String Injection in Zend Server
- CVE-2024-9127 Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter
- CVE-2024-9126 Use after free in Chrome
- CVE-2024-9125 king_IE <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9124 Rockwell Automation PowerFlex 6000T CIP Security denial-of-service Vulnerability
- CVE-2024-9123 Integer overflow in Chrome
- CVE-2024-9122 Memory corruption in Chrome
- CVE-2024-9121 Memory corruption in Chrome
- CVE-2024-9120 Use after free in Chrome
- CVE-2024-9119 SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9118 QS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9117 Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9116 Monkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9115 Common Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9114 FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-9113 FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-9112 FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-9111 Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9110 Cross-Site Scripting In Privileged Identity
- CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset
- CVE-2024-9108 Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload
- CVE-2024-9107 Stored XSS in gaizhenbiao/chuanhuchatgpt
- CVE-2024-9106 Wechat Social login <= 1.3.0 - Authentication Bypass
- CVE-2024-9105 UltimateAI <= 2.8.3 - Authentication Bypass
- CVE-2024-9104 UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
- CVE-2024-9103 Persistent XSS in blocked messages
- CVE-2024-9102 phpLDAPadmin: Improper Neutralization of Formula Elements
- CVE-2024-9101 phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php
- CVE-2024-9100 Local File Inclusion
- CVE-2024-9099 Exposure of Private API Keys in lunary-ai/lunary
- CVE-2024-9098 Privilege Escalation in lunary-ai/lunary
- CVE-2024-9097 IDOR
- CVE-2024-9096 Improper Authorization in lunary-ai/lunary
- CVE-2024-9095 Improper Authorization in lunary-ai/lunary
- CVE-2024-9094 code-projects Blood Bank System o-.php sql injection
- CVE-2024-9093 SourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injection
- CVE-2024-9092 SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting
- CVE-2024-9091 code-projects Student Record System index.php sql injection
- CVE-2024-9090 SourceCodester Modern Loan Management System search_member.php sql injection
- CVE-2024-9089 SourceCodester Modern Loan Management System update_loan_record.php cross site scripting
- CVE-2024-9088 SourceCodester Telecom Billing Management System login buffer overflow
- CVE-2024-9087 code-projects Vehicle Management edit1.php sql injection
- CVE-2024-9086 code-projects Restaurant Reservation System filter.php sql injection
- CVE-2024-9085 code-projects Restaurant Reservation System index.php sql injection
- CVE-2024-9084 code-projects Blood Bank System bbms.php cross site scripting
- CVE-2024-9083 SourceCodester Employee Management System add-admin.php cross site scripting
- CVE-2024-9082 SourceCodester Online Eyewear Shop User Creation Users.php improper authorization
- CVE-2024-9081 SourceCodester Online Eyewear Shop view_category.php sql injection
- CVE-2024-9080 code-projects Student Record System pincode-verification.php sql injection
- CVE-2024-9079 code-projects Student Record System marks.php sql injection
- CVE-2024-9078 code-projects Student Record System course.php sql injection
- CVE-2024-9077 dingfangzu Order Checkout order.js cross site scripting