Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 150 of 521.
- CVE-2024-8550 Local File Inclusion (LFI) in modelscope/agentscope
- CVE-2024-8549 Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting
- CVE-2024-8548 Missing authorization in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
- CVE-2024-8547 Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-8546 ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget
- CVE-2024-8544 Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting
- CVE-2024-8543 Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-8542 Everest Forms < 3.0.3.1 - Admin+ Stored XSS
- CVE-2024-8541 Cross-site scripting in Discount Rules for WooCommerce
- CVE-2024-8540 Misconfiguration in Sentry
- CVE-2024-8539 Missing authorization in Secure Access Client
- CVE-2024-8538 Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure
- CVE-2024-8537 Path Traversal in modelscope/agentscope
- CVE-2024-8536 Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS
- CVE-2024-8535 Authenticated user can access unintended user capabilities
- CVE-2024-8534 Memory safety vulnerability leading to memory corruption and Denial of Service
- CVE-2024-8533 Rockwell Automation OptixPanel™ Privilege Escalation Vulnerability via File Permissions
- CVE-2024-8531 Security feature bypass in Data Center Expert
- CVE-2024-8530 Missing authorization in Data Center Expert
- CVE-2024-8529 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
- CVE-2024-8528 ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter
- CVE-2024-8527 ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter
- CVE-2024-8526 Automated Logic WebCTRL and Carrier i-Vu Open Redirect
- CVE-2024-8525 Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload
- CVE-2024-8524 Directory Traversal in modelscope/agentscope
- CVE-2024-8523 lmxcms SQL Command Execution Module admin.php formatData code injection
- CVE-2024-8522 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
- CVE-2024-8521 Wavelog Live QSO qso index cross site scripting
- CVE-2024-8520 Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
- CVE-2024-8519 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-8518 Denial of service in Zelio Soft 2
- CVE-2024-8517 SPIP Bigup Multipart File Upload OS Command Injection
- CVE-2024-8516 Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information Exposure
- CVE-2024-8515 Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-8514 Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection
- CVE-2024-8513 QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update
- CVE-2024-8512 W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution
- CVE-2024-8510 N-central Path Traversal
- CVE-2024-8509 Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication
- CVE-2024-8508 Unbounded name compression could lead to Denial of Service
- CVE-2024-8507 File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-8505 Cross-site scripting in Ajax Load More – Infinite Scroll, Load More, & Lazy Load
- CVE-2024-8504 VICIdial Authenticated Remote Code Execution
- CVE-2024-8503 VICIdial Unauthenticated SQL Injection
- CVE-2024-8502 Remote Code Execution via Deserialization in modelscope/agentscope
- CVE-2024-8501 Arbitrary File Download in modelscope/agentscope
- CVE-2024-8500 Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-8499 Cross-site scripting in Checkout Field Editor (Checkout Manager) for WooCommerce
- CVE-2024-8497 Franklin Fueling Systems TS-550 EVO Absolute Path Traversal
- CVE-2024-8496 Privilege escalation in Workspace Control
- CVE-2024-8495 Null dereference in Connect Secure
- CVE-2024-8494 Information disclosure in Elementor Website Builder Pro
- CVE-2024-8493 The Events Calendar < 6.6.4 - Admin+ Stored XSS
- CVE-2024-8492 Hustle < 7.8.5 - Admin+ Stored XSS
- CVE-2024-8490 PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details
- CVE-2024-8489 CSRF due to overly permissive CORS headers in modelscope/agentscope
- CVE-2024-8488 Cross-site scripting in Survey Maker
- CVE-2024-8487 CORS Vulnerability in modelscope/agentscope
- CVE-2024-8486 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-8485 Missing authorization in REST API TO MiniProgram
- CVE-2024-8484 REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection
- CVE-2024-8483 MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure
- CVE-2024-8482 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-8481 Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-8480 File upload in Image Optimizer, Resizer and CDN – Sirv
- CVE-2024-8479 Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-8478 Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-8477 Cross-site request forgery in Brevo – Email, SMS, Web Push, Chat, and more.
- CVE-2024-8476 Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion
- CVE-2024-8475 Protection Mechanism Failure in Digital Operation Services' WiFiBurada
- CVE-2024-8474 Information disclosure in OpenVPN Connect
- CVE-2024-8473 SQL injection vulnerability in Job Portal
- CVE-2024-8472 SQL injection vulnerability in Job Portal
- CVE-2024-8471 SQL injection vulnerability in Job Portal
- CVE-2024-8470 SQL injection vulnerability in Job Portal
- CVE-2024-8469 SQL injection vulnerability in Job Portal
- CVE-2024-8468 SQL injection vulnerability in Job Portal
- CVE-2024-8467 SQL injection vulnerability in Job Portal
- CVE-2024-8466 SQL injection vulnerability in Job Portal
- CVE-2024-8465 SQL injection vulnerability in Job Portal
- CVE-2024-8464 SQL injection vulnerability in Job Portal
- CVE-2024-8463 File upload restriction bypass vulnerability in Job Portal
- CVE-2024-8462 Windmill HTTP Request users.rs excessive authentication
- CVE-2024-8461 D-Link DNS-320 Web Management Interface discovery.cgi information disclosure
- CVE-2024-8460 D-Link DNS-320 Web Management Interface widget_api.cgi information disclosure
- CVE-2024-8459 PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords
- CVE-2024-8458 PLANET Technology switch devices - Cross-site Request Forgery
- CVE-2024-8457 PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
- CVE-2024-8456 PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
- CVE-2024-8455 PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords
- CVE-2024-8454 PLANET Technology switch devices - Swctrl service DoS attack
- CVE-2024-8453 PLANET Technology switch devices - Weak hash for users' passwords
- CVE-2024-8452 PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials
- CVE-2024-8451 PLANET Technology switch devices - SSH server DoS attack
- CVE-2024-8450 PLANET Technology switch devices - Hard-coded SNMPv1 read-write community string
- CVE-2024-8449 PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials
- CVE-2024-8448 PLANET Technology switch devices - Remote privilege escalation using hard-coded credentials
- CVE-2024-8447 Narayana: deadlock via multiple join requests sent to lra coordinator
- CVE-2024-8445 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
- CVE-2024-8444 Download Manager < 3.3.00 - Contributor+ Stored XSS