Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 154 of 521.
- CVE-2024-8119 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page
- CVE-2024-8118 Grafana alerting wrong permission on datasource rule write endpoint
- CVE-2024-8117 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option
- CVE-2024-8116 Incorrect Authorization in GitLab
- CVE-2024-8114 Missing Authorization in GitLab
- CVE-2024-8113 Stored XSS in Placeholder Samples in Mail Preview
- CVE-2024-8112 thinkgem JeeSite Cookie login cross site scripting
- CVE-2024-8110 Denial of service in Dual-redundant Platform for Computer (PC2CKM)
- CVE-2024-8108 Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter
- CVE-2024-8107 Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-8106 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
- CVE-2024-8105 Insecure Platform Key (PK) used in UEFI system firmware signature
- CVE-2024-8104 Path traversal in The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-8103 WP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
- CVE-2024-8102 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-8101 Stored XSS in aimhubio/aim
- CVE-2024-8100 Privilege escalation in CloudVision
- CVE-2024-8099 Server-Side Request Forgery (SSRF) in vanna-ai/vanna
- CVE-2024-8097 Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
- CVE-2024-8096 OCSP stapling bypass with GnuTLS
- CVE-2024-8095 BabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSS
- CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF
- CVE-2024-8093 Posts reminder <= 0.20 - Settings Update via CSRF
- CVE-2024-8092 Accordion Image Menu <= 3.1.3 - Stored XSS via CSRF
- CVE-2024-8091 Enhanced Search Box <= 0.6.1 - Settings Update via CSRF
- CVE-2024-8090 JavaScript Logic <= 0.1 - CSRF to Stored XSS
- CVE-2024-8089 SourceCodester E-Commerce System controller.php unrestricted upload
- CVE-2024-8088 Infinite loop when iterating over zip archive entry names from zipfile.Path
- CVE-2024-8087 SourceCodester E-Commerce System popup_Item.php sql injection
- CVE-2024-8086 SourceCodester E-Commerce System Admin Login login.php sql injection
- CVE-2024-8085 PeoplePond <= 1.1.9 - CSRF to Stored XSS
- CVE-2024-8084 SourceCodester Online Computer and Laptop Store Setting SystemSettings.php cross site scripting
- CVE-2024-8083 SourceCodester Online Computer and Laptop Store Master.php sql injection
- CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF
- CVE-2024-8081 itsourcecode Payroll Management System login.php sql injection
- CVE-2024-8080 SourceCodester Online Health Care System search.php sql injection
- CVE-2024-8079 TOTOLINK AC1200 T8 exportOvpn buffer overflow
- CVE-2024-8078 TOTOLINK AC1200 T8 setTracerouteCfg buffer overflow
- CVE-2024-8077 TOTOLINK AC1200 T8 setTracerouteCfg os command injection
- CVE-2024-8076 TOTOLINK AC1200 T8 setDiagnosisCfg buffer overflow
- CVE-2024-8075 TOTOLINK AC1200 T8 setDiagnosisCfg os command injection
- CVE-2024-8074 Sensetive Data Exposure in Nomysoft Informatics' Nomysem
- CVE-2024-8073 Command Injection Vulnerability in Hillstone Networks Web Application Firewall
- CVE-2024-8072 Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
- CVE-2024-8071 System Role with edit access to permissions can elevate themselves to system admin
- CVE-2024-8070 Information disclosure in EVlink Home Smart
- CVE-2024-8069 Citrix Session Recording Deserialization of Untrusted Data
- CVE-2024-8068 Citrix Session Recording Improper Privilege Management
- CVE-2024-8067 Unicode "best fit" argument injection
- CVE-2024-8066 File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-8065 CSRF in danswer-ai/danswer
- CVE-2024-8063 Divide by Zero in ollama/ollama
- CVE-2024-8062 Denial of Service in h2oai/h2o-3
- CVE-2024-8061 Denial of Service in aimhubio/aim
- CVE-2024-8059 Information disclosure in HX Enclosure Certified Node (ThinkAgile) XCC
- CVE-2024-8058 Path traversal in FileZ Client
- CVE-2024-8057 Improper Access Control in danswer-ai/danswer
- CVE-2024-8056 MM-Breaking News <= 0.7.9 - Reflected XSS
- CVE-2024-8055 Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna
- CVE-2024-8054 MM-Breaking News <= 0.7.9 - Stored XSS via CSRF
- CVE-2024-8053 Improper Authentication in open-webui/open-webui
- CVE-2024-8052 Review Ratings <= 1.6 - Stored XSS via CSRF
- CVE-2024-8051 Special Feed Items <= 1.0.1 - Stored XSS via CSRF
- CVE-2024-8050 Custom Author Base <= 1.1.1 - Settings Update via CSRF
- CVE-2024-8049 Telerik Document Processing Improper Handling of Memory Resources
- CVE-2024-8048 Telerik Reporting Insecure Expression Evaluation
- CVE-2024-8047 Visual Sound (old) <= 1.06 - Settings Update via CSRF
- CVE-2024-8046 Cross-site scripting in Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid
- CVE-2024-8045 Cross-site scripting in Advanced WordPress Backgrounds
- CVE-2024-8044 infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRF
- CVE-2024-8043 Vikinghammer Tweet <= 0.2.4 - Stored XSS via CSRF
- CVE-2024-8042 Rapid7 Insight Platform Unauthorized Empty Group Creation
- CVE-2024-8041 Uncontrolled Resource Consumption in GitLab
- CVE-2024-8040 Missing authorization in 3DSwymer
- CVE-2024-8039 Misconfiguration in com.afmobi.boomplayer
- CVE-2024-8038 Vulnerable juju introspection abstract UNIX domain socket
- CVE-2024-8037 Vulnerable juju hook tool abstract UNIX domain socket
- CVE-2024-8036 Unauthorized Modifications of Firmware and Configuration
- CVE-2024-8035 Other in Chrome
- CVE-2024-8034 Other in Chrome
- CVE-2024-8033 Other in Chrome
- CVE-2024-8032 Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSS
- CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download
- CVE-2024-8030 Deserialization in Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor
- CVE-2024-8029 Stored XSS in imartinez/privategpt
- CVE-2024-8028 Denial of Service in danswer-ai/danswer
- CVE-2024-8027 Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything
- CVE-2024-8026 CSRF due to overly permissive CORS headers in netease-youdao/qanything
- CVE-2024-8025 Nikon NEF Codec Thumbnail Provider NRW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-8024 CORS Misconfiguration in netease-youdao/qanything
- CVE-2024-8023 chillzhuang SpringBlade list sql injection
- CVE-2024-8022 Genexis Tilgin Home Gateway cross site scripting
- CVE-2024-8021 Open Redirect in gradio-app/gradio
- CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning
- CVE-2024-8019 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
- CVE-2024-8018 Denial of Service (DOS) in imartinez/privategpt
- CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
- CVE-2024-8016 The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution
- CVE-2024-8015 Telerik Report Server Insecure Type Resolution
- CVE-2024-8014 Telerik Reporting EntityDataSource Insecure Type Resolution