Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 156 of 521.
- CVE-2024-7905 DedeBIZ archives_do.php AdminUpload unrestricted upload
- CVE-2024-7904 DedeBIZ File Extension file_manage_control.php unrestricted upload
- CVE-2024-7903 DedeBIZ File Extension media_add.php unrestricted upload
- CVE-2024-7902 pkp ojs signOut redirect
- CVE-2024-7901 Scada-LTS Message Scada cross site scripting
- CVE-2024-7900 xiaohe4966 TpMeCMS Basic Configuration config cross site scripting
- CVE-2024-7899 InnoCMS Backend edit code injection
- CVE-2024-7898 Tosei Online Store Management System ネット店舗管理システム Backend default credentials
- CVE-2024-7897 Tosei Online Store Management System ネット店舗管理システム tosei_kikai.php command injection
- CVE-2024-7896 Tosei Online Store Management System ネット店舗管理システム p1_ftpserver.php command injection
- CVE-2024-7895 Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
- CVE-2024-7894 If Menu <= 0.19.1 - Missing Authorization to License Key Update
- CVE-2024-7892 adstxt Plugin <= 1.0.0 - Settings Update via CSRF
- CVE-2024-7891 Floating Contact Button < 2.8 - Admin+ Stored XSS
- CVE-2024-7890 Local privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2024-7889 Local privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2024-7888 Classified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorization
- CVE-2024-7887 LimeSurvey File Upload index.php denial of service
- CVE-2024-7886 Scooter Software Beyond Compare 7zxa.dll uncontrolled search path
- CVE-2024-7885 Undertow: improper state management in proxy protocol parsing causes information leakage
- CVE-2024-7884 Memory leak when calling a canister method via `ic_cdk::call`
- CVE-2024-7883 CMSE secure state may leak from stack to floating-point registers
- CVE-2024-7882 SQLi in Special Minds' e-Commerce
- CVE-2024-7881 Information disclosure in C1-Premium
- CVE-2024-7879 WP ULike < 4.7.5 - Admin+ Stored XSS via Widgets
- CVE-2024-7878 WP ULike < 4.7.4 - Admin+ Stored XSS
- CVE-2024-7877 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
- CVE-2024-7876 Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
- CVE-2024-7875 XSS in Tungsten Automation TotalAgility
- CVE-2024-7874 XSS in Tungsten Automation TotalAgility
- CVE-2024-7873 Stored XSS in Veribilim Software's Veribase Order Management
- CVE-2024-7872 Sensetive Data Exposure in ExtremePACS' Extreme XDS
- CVE-2024-7871 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-7870 Information disclosure in PixelYourSite Pro – Your smart PIXEL (TAG) Manager
- CVE-2024-7869 123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-7868 Uninitialized variable in Xpdf 4.05 due to invalid JPEG header
- CVE-2024-7867 Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates
- CVE-2024-7866 Stack overflow in Xpdf 4.05 due to object loop in PDF pattern
- CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF
- CVE-2024-7863 Favicon Generator < 2.1 - Arbitrary File Upload via CSRF
- CVE-2024-7862 Blog Introduction <= 0.3.0 - Settings Update via CSRF
- CVE-2024-7861 Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF
- CVE-2024-7860 Simple Headline Rotator <= 1.0 - Stored XSS via CSRF
- CVE-2024-7859 Visual Sound <= 1.03 - Settings Update via CSRF
- CVE-2024-7858 Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions
- CVE-2024-7857 Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection
- CVE-2024-7856 Missing authorization in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- CVE-2024-7855 WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-7854 Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
- CVE-2024-7853 SourceCodester Yoga Class Registration System sql injection
- CVE-2024-7852 SourceCodester Yoga Class Registration System view_inquiry.php cross site scripting
- CVE-2024-7851 SourceCodester Yoga Class Registration System Add User Users.php improper authorization
- CVE-2024-7850 BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-7849 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_create_album buffer overflow
- CVE-2024-7848 User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
- CVE-2024-7847 RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script
- CVE-2024-7846 YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS
- CVE-2024-7845 SourceCodester Online Graduate Tracer System fetch_it.php sql injection
- CVE-2024-7844 SourceCodester Online Graduate Tracer System add_acc.php cross site scripting
- CVE-2024-7843 SourceCodester Online Graduate Tracer System exportcs.php information disclosure
- CVE-2024-7842 SourceCodester Online Graduate Tracer System export_it.php information disclosure
- CVE-2024-7841 SourceCodester Clinics Patient Management System check_user_name.php sql injection
- CVE-2024-7840 Improper neutralization special element in hyperlinks
- CVE-2024-7839 itsourcecode Billing System addbill.php sql injection
- CVE-2024-7838 itsourcecode Online Food Ordering System addcategory.php sql injection
- CVE-2024-7837 SQLi in Firmanet Software's ERP
- CVE-2024-7836 Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
- CVE-2024-7835 Reflected XSS in Exnet Informatics Software's Ferry Reservation System
- CVE-2024-7834 Local privilege escalation in Overwolf
- CVE-2024-7833 D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injection
- CVE-2024-7832 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflow
- CVE-2024-7831 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_cooliris buffer overflow
- CVE-2024-7830 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_move_photo buffer overflow
- CVE-2024-7829 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_del_photo buffer overflow
- CVE-2024-7828 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflow
- CVE-2024-7827 Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter
- CVE-2024-7826 Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
- CVE-2024-7825 Type confusion that can cause the WRSA.exe service to crash and generate a crash dump
- CVE-2024-7824 Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
- CVE-2024-7822 Quick Code <= 1.0 - Stored XSS via CSRF
- CVE-2024-7820 ILC Thickbox <= 1.0 - Settings update via CSRF
- CVE-2024-7819 CORS Misconfiguration in danswer-ai/danswer
- CVE-2024-7818 Misiek Photo Album <= 1.4.3 - Stored XSS via CSRF
- CVE-2024-7817 Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF
- CVE-2024-7816 Gixaw Chat <= 1.0 - Stored XSS via CSRF
- CVE-2024-7815 CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
- CVE-2024-7814 CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scripting
- CVE-2024-7813 SourceCodester Prison Management System Profile Image insufficiently protected credentials
- CVE-2024-7812 SourceCodester Best House Rental Management System POST Parameter ajax.php cross site scripting
- CVE-2024-7811 SourceCodester Daily Expenses Monitoring App delete-expense.php sql injection
- CVE-2024-7810 SourceCodester Online Graduate Tracer System view_itprofile.php sql injection
- CVE-2024-7809 SourceCodester Online Graduate Tracer System nbproject exposure of information through directory listing
- CVE-2024-7808 code-projects Job Portal logindbc.php sql injection
- CVE-2024-7807 Denial of Service (DOS) in gaizhenbiao/chuanhuchatgpt
- CVE-2024-7803 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-7801 SQL injection in get_chart_data in TimeProvider 4100
- CVE-2024-7800 SourceCodester Simple Online Bidding System ajax.php sql injection
- CVE-2024-7799 SourceCodester Simple Online Bidding System users.php improper authorization
- CVE-2024-7798 SourceCodester Simple Online Bidding System ajax.php sql injection
- CVE-2024-7797 SourceCodester Simple Online Bidding System ajax.php sql injection