Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 164 of 521.
- CVE-2024-7041 IDOR in open-webui/open-webui
- CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
- CVE-2024-7032 Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion
- CVE-2024-7031 File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update
- CVE-2024-7030 Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update
- CVE-2024-7029 Command Injection in AVTech AVM1203 (IP Camera)
- CVE-2024-7027 WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor
- CVE-2024-7026 SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking Software
- CVE-2024-7025 Integer overflow in Chrome
- CVE-2024-7024 Memory corruption in Chrome
- CVE-2024-7023 Privilege escalation in Chrome
- CVE-2024-7022 Memory corruption in Chrome
- CVE-2024-7021 Other in Chrome
- CVE-2024-7020 Other in Chrome
- CVE-2024-7019 Other in Chrome
- CVE-2024-7018 Memory corruption in Chrome
- CVE-2024-7017 Race condition in Chrome
- CVE-2024-7016 Stored XSS in Smarttek Informatics' Smart Doctor
- CVE-2024-7015 Improper Authentication in Profelis Informatics and Consulting's PassBOX
- CVE-2024-7014 Improper multimedia file attachment validation in Telegram for Android app
- CVE-2024-7013 Memory corruption in Control FPWIN Pro
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7011 Denial of service in NP-CA4120X
- CVE-2024-7010 Timing Attack in mudler/localai
- CVE-2024-7009 Calibre SQL Injection
- CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)
- CVE-2024-7007 Authentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA7005
- CVE-2024-7006 Libtiff: null pointer dereference in tif_dirinfo.c
- CVE-2024-7005 Security feature bypass in Chrome
- CVE-2024-7004 Security feature bypass in Chrome
- CVE-2024-7003 Other in Chrome
- CVE-2024-7001 Other in Chrome
- CVE-2024-7000 Use after free in Chrome
- CVE-2024-6999 Other in Chrome
- CVE-2024-6998 Use after free in Chrome
- CVE-2024-6997 Use after free in Chrome
- CVE-2024-6996 Race condition in Chrome
- CVE-2024-6995 Security feature bypass in Chrome
- CVE-2024-6994 Memory corruption in Chrome
- CVE-2024-6991 Use after free in Chrome
- CVE-2024-6990 Memory corruption in Chrome
- CVE-2024-6989 Use after free in Chrome
- CVE-2024-6988 Use after free in Chrome
- CVE-2024-6987 Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
- CVE-2024-6986 Cross-site Scripting (XSS) in parisneo/lollms-webui
- CVE-2024-6985 Path Traversal in api open_personality_folder in parisneo/lollms-webui
- CVE-2024-6984 Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
- CVE-2024-6983 Remote Code Execution in mudler/localai
- CVE-2024-6982 Remote Code Execution in Calculate Function in parisneo/lollms
- CVE-2024-6981 OMNTEC Proteus Tank Monitoring Missing Authentication for Critical Function
- CVE-2024-6980 Verbose error handling issue in GravityZone Update Server proxy service
- CVE-2024-6979 Privilege escalation in AXIS OS
- CVE-2024-6978 Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users
- CVE-2024-6977 Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover
- CVE-2024-6975 Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file
- CVE-2024-6974 Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade
- CVE-2024-6973 Remote Code Execution in Cato Windows SDP client via crafted URLs
- CVE-2024-6972 Information disclosure in Octopus Server
- CVE-2024-6971 Path Traversal in parisneo/lollms-webui
- CVE-2024-6970 itsourcecode Tailoring Management System staffcatadd.php sql injection
- CVE-2024-6969 SourceCodester Clinics Patient Management System get_patient_history.php sql injection
- CVE-2024-6968 SourceCodester Clinics Patient Management System print_patients_visits.php sql injection
- CVE-2024-6967 SourceCodester Employee and Visitor Gate Pass Logging System sql injection
- CVE-2024-6966 itsourcecode Online Blood Bank Management System Login login.php sql injection
- CVE-2024-6965 Tenda O3 fromVirtualSet stack-based overflow
- CVE-2024-6964 Tenda O3 fromDhcpSetSer stack-based overflow
- CVE-2024-6963 Tenda O3 formexeCommand stack-based overflow
- CVE-2024-6962 Tenda O3 formQosSet stack-based overflow
- CVE-2024-6961 XXE in Guardrails AI when consuming RAIL documents
- CVE-2024-6960 H2O deserializes ML models without filtering, potentially allowing execution of malicious code
- CVE-2024-6959 Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui
- CVE-2024-6958 itsourcecode University Management System Avatar File st_update.php unrestricted upload
- CVE-2024-6957 itsourcecode University Management System Login functions.php sql injection
- CVE-2024-6956 itsourcecode University Management System view_cgpa.php sql injection
- CVE-2024-6955 SourceCodester Record Management System sort2.php cross site scripting
- CVE-2024-6954 SourceCodester Record Management System sort1.php cross site scripting
- CVE-2024-6953 itsourcecode Tailoring Management System sms.php sql injection
- CVE-2024-6952 itsourcecode University Management System sql injection
- CVE-2024-6951 SourceCodester Simple Online Book Store System admin_delete.php sql injection
- CVE-2024-6950 Prain HTTP POST Request ?import code injection
- CVE-2024-6949 Gargaj wuhu path traversal
- CVE-2024-6948 Gargaj wuhu Slide Editor slideeditor.php unrestricted upload
- CVE-2024-6947 Flute CMS Notification ContentParser.php replaceContent code injection
- CVE-2024-6946 Flute CMS list code injection
- CVE-2024-6945 Flute CMS Avatar Upload Page ImagesController.php unrestricted upload
- CVE-2024-6944 ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization
- CVE-2024-6943 ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization
- CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting
- CVE-2024-6941 ThinkSAAS do.php cross site scripting
- CVE-2024-6940 DedeCMS article_template_rand.php code injection
- CVE-2024-6939 Xinhu RockOA tpl_upload.html okla cross site scripting
- CVE-2024-6938 SiYuan PDF PDF.js cross site scripting
- CVE-2024-6937 formtools.org Form Tools Import Option List edit.php curl_exec file inclusion
- CVE-2024-6936 formtools.org Form Tools Setting code injection
- CVE-2024-6935 formtools.org Form Tools User Settings Page cross site scripting
- CVE-2024-6934 formtools.org Form Tools cross site scripting
- CVE-2024-6933 SQL injection in LimeSurvey
- CVE-2024-6932 ClassCMS cross site scripting
- CVE-2024-6931 The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-6930 WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode