Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 163 of 521.
- CVE-2024-7161 SeaCMS Password Change cross-site request forgery
- CVE-2024-7160 TOTOLINK A3700R cstecgi.cgi setWanCfg command injection
- CVE-2024-7159 TOTOLINK A3600R Telnet Service product.ini hard-coded password
- CVE-2024-7158 TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection
- CVE-2024-7157 TOTOLINK A3100R getSaveConfig buffer overflow
- CVE-2024-7156 TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure
- CVE-2024-7155 TOTOLINK A3300R shadow.sample hard-coded password
- CVE-2024-7154 TOTOLINK A3700R Password Reset wizard.html access control
- CVE-2024-7153 Netgear WN604 siteSurvey.php direct request
- CVE-2024-7152 Tenda O3 setMacFilterList fromSafeSetMacFilter stack-based overflow
- CVE-2024-7151 Tenda O3 setMacFilter fromMacFilterSet stack-based overflow
- CVE-2024-7150 Slider by 10Web – Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter
- CVE-2024-7149 Path traversal in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2024-7147 JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-7146 JetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion
- CVE-2024-7145 JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion
- CVE-2024-7144 JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-7143 Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
- CVE-2024-7142 Security feature bypass in CloudVision Appliance
- CVE-2024-7141 CSRF in Gliffy
- CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK
- CVE-2024-7138 Denial of Service in Silicon Labs RS9116 Bluetooth SDK
- CVE-2024-7137 Denial of Service in Silicon Labs RS9116 Bluetooth SDK
- CVE-2024-7136 JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-7135 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
- CVE-2024-7134 LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter
- CVE-2024-7133 My Sticky Bar < 2.7.3 - Admin+ Stored XSS
- CVE-2024-7132 CoBlocks < 3.1.13 - Editor+ Stored XSS
- CVE-2024-7130 Reflected XSS in Kion Computer's KION Exchange Programs Software
- CVE-2024-7129 Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
- CVE-2024-7128 Openshift-console: unauthenticated data exposure
- CVE-2024-7127 XSS in Stackposts - Social Marketing Tool
- CVE-2024-7125 Authentication Bypass Vulnerability in Hitachi Ops Center Common Services
- CVE-2024-7124 Reflected XSS in DInGO dLibra
- CVE-2024-7122 Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-7120 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection
- CVE-2024-7119 MD-MAFUJUL-HASAN Online-Payroll-Management-System employee_viewmore.php sql injection
- CVE-2024-7118 MD-MAFUJUL-HASAN Online-Payroll-Management-System department_viewmore.php sql injection
- CVE-2024-7117 MD-MAFUJUL-HASAN Online-Payroll-Management-System shift_viewmore.php sql injection
- CVE-2024-7116 MD-MAFUJUL-HASAN Online-Payroll-Management-System branch_viewmore.php sql injection
- CVE-2024-7115 MD-MAFUJUL-HASAN Online-Payroll-Management-System designation_viewmore.php sql injection
- CVE-2024-7114 Tianchoy Blog so.php sql injection
- CVE-2024-7113 Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server
- CVE-2024-7112 Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
- CVE-2024-7110 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- CVE-2024-7108 Incorrect Authorization in National Keep's CyberMath
- CVE-2024-7107 Directory Traversal in National Keep's CyberMath
- CVE-2024-7106 Spina CMS media_folders cross-site request forgery
- CVE-2024-7105 ForIP Tecnologia Administração PABX Lista Ura Page detalheIdUra sql injection
- CVE-2024-7104 Remote Code Execution in SFS Consulting's ww.Winsure
- CVE-2024-7103 Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow
- CVE-2024-7102 Execution with Unnecessary Privileges in GitLab
- CVE-2024-7101 ForIP Tecnologia Administração PABX Authentication Form login sql injection
- CVE-2024-7100 Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
- CVE-2024-7099 SQL Injection in netease-youdao/qanything
- CVE-2024-7098 XML Injection in SFS Consulting's ww.Winsure
- CVE-2024-7097 Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- CVE-2024-7096 Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
- CVE-2024-7095 Denial of service in EOS
- CVE-2024-7094 Code injection in JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates
- CVE-2024-7092 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-7091 Exposure of Sensitive Information to an Unauthorized Actor in GitLab
- CVE-2024-7090 LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting
- CVE-2024-7085 Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM).
- CVE-2024-7084 Ajax Search Lite < 4.12.1 - Admin+ Stored XSS
- CVE-2024-7083 Email Encoder < 2.3.4 - Admin+ Stored XSS
- CVE-2024-7082 easy-table-of-contents < 2.0.68 - Editor+ Stored XSS
- CVE-2024-7081 itsourcecode Tailoring Management System expcatadd.php sql injection
- CVE-2024-7080 SourceCodester Insurance Management System direct request
- CVE-2024-7079 Openshift-console: unauthenticated installation of helm charts
- CVE-2024-7078 Unauthenticate SQLi in Semtek Informatics Software's Semtek Sempos
- CVE-2024-7077 Reflected XSS in Semtek Informatics Software's Semtek Sempos
- CVE-2024-7076 SQLi in Semtek Informatics Software's Semtek Sempos
- CVE-2024-7074 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
- CVE-2024-7073 Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- CVE-2024-7071 Unauthenticate SQLi in Brain Information Technologies' Brain Low-Code
- CVE-2024-7069 SourceCodester Employee and Visitor Gate Pass Logging System sql injection
- CVE-2024-7068 SourceCodester Insurance Management System update_sub_category cross site scripting
- CVE-2024-7067 kirilkirkov Ecommerce-Laravel-Bootstrap Cart.php getCartProductsIds deserialization
- CVE-2024-7066 F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection
- CVE-2024-7065 Spina CMS cross-site request forgery
- CVE-2024-7064 ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-7063 ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure
- CVE-2024-7062 Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087
- CVE-2024-7061 Privilege escalation in Okta Verify for Windows
- CVE-2024-7060 Exposure of Sensitive Information to an Unauthorized Actor in GitLab
- CVE-2024-7059 Code injection in Genetec Security Center
- CVE-2024-7058 Relative Path Traversal in parisneo/lollms-webui
- CVE-2024-7057 Improper Access Control in GitLab
- CVE-2024-7056 WPForms < 1.9.1.6 - Admin+ Stored XSS
- CVE-2024-7055 FFmpeg pnmdec.c pnm_decode_frame heap-based overflow
- CVE-2024-7054 Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-7052 Forminator < 1.38.3 - Admin+ Stored XSS
- CVE-2024-7050 Auth bypass in OpenText Directory Services
- CVE-2024-7048 IDOR in open-webui/open-webui
- CVE-2024-7047 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-7044 Stored XSS in open-webui/open-webui
- CVE-2024-7043 Improper Access Control in open-webui/open-webui
- CVE-2024-7042 Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection