Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 145 of 521.
- CVE-2024-9076 DedeCMS article_string_mix.php os command injection
- CVE-2024-9075 Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
- CVE-2024-9074 Advanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9073 Cross-site scripting in GutenGeek Free Gutenberg Blocks for WordPress
- CVE-2024-9072 Cross-site scripting in GDPR-Extensions-com – Consent Manager
- CVE-2024-9071 Cross-site scripting in Easy Demo Importer – A Modern One-Click Demo Import Solution
- CVE-2024-9070 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml
- CVE-2024-9069 Cross-site scripting in Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery )
- CVE-2024-9068 OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9067 Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
- CVE-2024-9066 Marketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9065 WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test
- CVE-2024-9064 Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9062 macOS Archify: Local Privilege Escalation
- CVE-2024-9061 Code injection in WP Popup Builder – Popup Forms and Marketing Lead Generation
- CVE-2024-9060 AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-9059 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-9058 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-9057 Cross-site scripting in Curator.io
- CVE-2024-9056 Denial of Service in bentoml/bentoml
- CVE-2024-9055 DPA Countermeasures need reseeding
- CVE-2024-9054 Remote code Execution inTimeProvider® 4100
- CVE-2024-9053 Remote Code Execution in vllm-project/vllm
- CVE-2024-9051 Cross-site scripting in WP Ultimate Post Grid
- CVE-2024-9050 Networkmanager-libreswan: local privilege escalation via leftupdown
- CVE-2024-9049 Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder
- CVE-2024-9048 y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
- CVE-2024-9047 Path traversal in Iptanus File Upload
- CVE-2024-9046 Privilege escalation in stARstudio
- CVE-2024-9044 XML External Entity (XXE) Vulnerability in EasyTax
- CVE-2024-9043 Cellopoint Secure Email Gateway - Buffer Overflow
- CVE-2024-9042 Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API
- CVE-2024-9041 SourceCodester Best House Rental Management System ajax.php sql injection
- CVE-2024-9040 code-projects Blood Bank Management System Password cleartext storage in a file or on disk
- CVE-2024-9039 SourceCodester Best House Rental Management System ajax.php sql injection
- CVE-2024-9038 Codezips Online Shopping Portal insert-product.php unrestricted upload
- CVE-2024-9037 Codezips Internal Marks Calculation index.php sql injection
- CVE-2024-9036 itsourcecode Online Bookstore admin_add.php unrestricted upload
- CVE-2024-9035 code-projects Blood Bank Management System Admin Login login.php sql injection
- CVE-2024-9034 code-projects Patient Record Management System login.php sql injection
- CVE-2024-9033 SourceCodester Best House Rental Management System ajax.php cross site scripting
- CVE-2024-9032 SourceCodester Simple Forum-Discussion System index.php path traversal
- CVE-2024-9031 CodeCanyon CRMGo SaaS show cross site scripting
- CVE-2024-9030 CodeCanyon CRMGo SaaS note cross site scripting
- CVE-2024-9029 Freeimage: heap buffer overflow in tiff_read_iptc_profile
- CVE-2024-9028 WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode
- CVE-2024-9027 WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
- CVE-2024-9026 PHP-FPM logs from children may be altered
- CVE-2024-9025 Missing authorization in Sight – Professional Image Gallery and Portfolio
- CVE-2024-9024 Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode
- CVE-2024-9023 WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode
- CVE-2024-9022 SQL injection in TS Poll – Survey, Versus Poll, Image Poll, Video Poll
- CVE-2024-9021 Relevanssi < 4.23.1 - Contributor+ Stored XSS
- CVE-2024-9020 List category posts < 0.90.3 - Author+ Stored XSS
- CVE-2024-9019 Cross-site scripting in SecuPress with Simple SSL – Simple and Performant Security
- CVE-2024-9018 WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter
- CVE-2024-9017 PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description
- CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2024-9011 code-projects Crud Operation System updata.php sql injection
- CVE-2024-9009 code-projects Online Quiz Site showtest.php sql injection
- CVE-2024-9008 SourceCodester Best Online News Portal Comment Section news-details.php sql injection
- CVE-2024-9007 jeanmarc77 123solar detailed.php cross site scripting
- CVE-2024-9006 jeanmarc77 123solar config_invt1.php code injection
- CVE-2024-9005 Deserialization in EcoStruxure Power Monitoring Expert (PME)
- CVE-2024-9004 D-Link DAR-7000 Backup_Server_commit.php os command injection
- CVE-2024-9003 Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control
- CVE-2024-9002 Privilege escalation in Easergy Studio
- CVE-2024-9001 TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injection
- CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary
- CVE-2024-8999 Improper Access Control in lunary-ai/lunary
- CVE-2024-8998 Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary
- CVE-2024-8997 SQLi in Vestel's EVC04 Configuration Interface
- CVE-2024-8996 Grafana Agent Flow on Windows Unquoted service path
- CVE-2024-8995 Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
- CVE-2024-8994 Information disclosure in Magic OS
- CVE-2024-8993 Information disclosure in Magic OS
- CVE-2024-8992 Information disclosure in Magic OS
- CVE-2024-8991 OSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes
- CVE-2024-8990 Cross-site scripting in Geo Mashup
- CVE-2024-8989 Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode
- CVE-2024-8988 Missing authorization in PeepSo Core: File Uploads
- CVE-2024-8987 Cross-site scripting in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
- CVE-2024-8986 Information Leakage in grafana-plugin-sdk-go
- CVE-2024-8985 Cross-site scripting in Social Proof (Testimonial) Slider
- CVE-2024-8984 Denial of Service (DoS) in berriai/litellm
- CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
- CVE-2024-8982 Local File Inclusion in bentoml/openllm
- CVE-2024-8981 Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting
- CVE-2024-8980 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
- CVE-2024-8979 Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-8978 Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-8977 Server-Side Request Forgery (SSRF) in GitLab
- CVE-2024-8975 Grafana Alloy on Windows Unquoted service path
- CVE-2024-8974 Incorrect Provision of Specified Functionality in GitLab
- CVE-2024-8973 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-8972 SQLi in Mobil365 Informatics' Saha365 App
- CVE-2024-8970 Incorrect Authorization in GitLab
- CVE-2024-8969 The SYSCOM Group OMFLOW - Exposure of Sensitive Data
- CVE-2024-8968 MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color
- CVE-2024-8967 Cross-site scripting in PWA — easy way to Progressive Web App