Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 165 of 521.
- CVE-2024-6929 Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter
- CVE-2024-6928 Opti Marketing <= 2.0.9 - Unauthenticated SQLi
- CVE-2024-6927 Viral Signup <= 2.1 - Admin+ Stored XSS
- CVE-2024-6926 Viral Signup <= 2.1 - Unauthenticated SQLi
- CVE-2024-6925 TrueBooker < 1.0.3 - Settings Update via CSRF
- CVE-2024-6924 TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi
- CVE-2024-6923 Email header injection due to unquoted newlines
- CVE-2024-6922 Server-Side Request Forgery in Automation 360
- CVE-2024-6921 Cleartext Username and Password in NAC Telecommunication's NACPremium
- CVE-2024-6920 Stored XSS in NAC Telecommunication's NACPremium
- CVE-2024-6919 SQLi in NAC Telecommunication's NACPremium
- CVE-2024-6918 Memory corruption in Accutech Manager
- CVE-2024-6917 RCE in Veribilim Software's Veribase Order Management
- CVE-2024-6916 Zowe CLI --show-inputs-only displays securely stored properties
- CVE-2024-6915 JFrog Artifactory Cache Poisoning
- CVE-2024-6914 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- CVE-2024-6913 Execution with Unnecessary Privileges
- CVE-2024-6912 Hardcoded MSSQL Credentials
- CVE-2024-6911 Unauthenticated Local File Inclusion
- CVE-2024-6910 EventON < 2.2.17 - Admin+ Stored XSS
- CVE-2024-6908 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request
- CVE-2024-6907 SourceCodester Record Management System sort.php cross site scripting
- CVE-2024-6906 SourceCodester Record Management System add_leave_non_user.php sql injection
- CVE-2024-6905 SourceCodester Record Management System view_info_user.php sql injection
- CVE-2024-6904 SourceCodester Record Management System sort2_user.php sql injection
- CVE-2024-6903 SourceCodester Record Management System sort1_user.php sql injection
- CVE-2024-6902 SourceCodester Record Management System sort_user.php sql injection
- CVE-2024-6901 SourceCodester Record Management System entry.php sql injection
- CVE-2024-6900 SourceCodester Record Management System edit_emp.php sql injection
- CVE-2024-6899 SourceCodester Record Management System view_info.php sql injection
- CVE-2024-6898 SourceCodester Record Management System index.php sql injection
- CVE-2024-6897 aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-6896 Cross-site scripting in AMP for WP – Accelerated Mobile Pages
- CVE-2024-6895 Insecure Account Profile Management
- CVE-2024-6894 RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-6893 Journyx Unauthenticated XML External Entities Injection
- CVE-2024-6892 Journyx Reflected Cross Site Scripting
- CVE-2024-6891 Journyx Authenticated Remote Code Execution
- CVE-2024-6890 Journyx Unauthenticated Password Reset Bruteforce
- CVE-2024-6889 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS
- CVE-2024-6888 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS
- CVE-2024-6887 Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS
- CVE-2024-6886 Inproper Sanitation of field leading to stored XSS
- CVE-2024-6885 Path traversal in MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites
- CVE-2024-6884 Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Contributor+ Stored XSS
- CVE-2024-6883 Missing authorization in Event Espresso – Event Registration & Ticketing Sales
- CVE-2024-6881 Stored XSS Vulnerability
- CVE-2024-6880 CSRF in MegaBIP
- CVE-2024-6879 Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSS
- CVE-2024-6878 Directory Browsing in Eliz Software's Panel
- CVE-2024-6877 Reflected XSS in Eliz Software's Panel
- CVE-2024-6876 Out-of-bounds read in OSCAT-Library
- CVE-2024-6875 Infinispan: infinispan: rest compare api has buffer leak
- CVE-2024-6874 macidn punycode buffer overread
- CVE-2024-6873 Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.
- CVE-2024-6872 Missing authorization in TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder
- CVE-2024-6871 G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2024-6870 Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
- CVE-2024-6869 Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure
- CVE-2024-6868 Arbitrary File Write in mudler/LocalAI
- CVE-2024-6867 Information Disclosure in lunary-ai/lunary
- CVE-2024-6866 Case-Insensitive Path Matching in corydolphin/flask-cors
- CVE-2024-6864 Cross-site scripting in WP Last Modified Info
- CVE-2024-6863 Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3
- CVE-2024-6862 Cross-Site Request Forgery (CSRF) in lunary-ai/lunary
- CVE-2024-6861 Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api
- CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF
- CVE-2024-6859 WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
- CVE-2024-6858 Auth bypass in EOS
- CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF
- CVE-2024-6856 WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF
- CVE-2024-6855 WP MultiTasking <= 0.1.12 - Exit Popup Update via CSRF
- CVE-2024-6854 Arbitrary File Overwrite in h2oai/h2o-3
- CVE-2024-6853 WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF
- CVE-2024-6852 WP MultiTasking <= 0.1.12 - Settings Update via CSRF
- CVE-2024-6851 Arbitrary File Deletion in aimhubio/aim
- CVE-2024-6850 Carousel Slider < 2.2.14 - Editor+ Stored XSS
- CVE-2024-6849 Cross-site scripting in Preloader Plus – WordPress Loading Screen Plugin
- CVE-2024-6848 Cross-site scripting in Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
- CVE-2024-6847 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi
- CVE-2024-6846 SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
- CVE-2024-6845 SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
- CVE-2024-6844 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
- CVE-2024-6843 SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS
- CVE-2024-6842 Exposure of Sensitive Information in mintplex-labs/anything-llm
- CVE-2024-6841 CSRF in vanna-ai/vanna
- CVE-2024-6840 Automation-controller: gain access to the k8s api server via job execution with container group
- CVE-2024-6839 Improper Regex Path Matching in corydolphin/flask-cors
- CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow
- CVE-2024-6836 Missing authorization in FunnelKit – Funnel Builder for WooCommerce Checkout
- CVE-2024-6835 Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
- CVE-2024-6834 Imperative Local Command Injection allows Activity Masking
- CVE-2024-6833 Zowe CLI Auto-Init Leaks Credentials Locally
- CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- CVE-2024-6831 Missing authorization in AXIS Camera Station
- CVE-2024-6830 SourceCodester Simple Inventory Management System Order action.php sql injection
- CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim
- CVE-2024-6828 Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
- CVE-2024-6827 HTTP Request Smuggling in benoitc/gunicorn
- CVE-2024-6826 Allocation of Resources Without Limits or Throttling in GitLab