Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 167 of 521.
- CVE-2024-6720 Light Poll <= 1.0.0 - Poll Answers Deletion via CSRF
- CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF
- CVE-2024-6718 PVN Auth Popup <= 1.0.0 - Contributor+ XSS via Shortcode
- CVE-2024-6717 Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
- CVE-2024-6715 Ditty 3.1.39-3.1.45 - Author+ Stored XSS
- CVE-2024-6714 Privilege escalation in Ubuntu Desktop Provision
- CVE-2024-6713 PVN Auth Popup <= 1.0.0 - Admin+ Stored XSS
- CVE-2024-6712 MapFig Studio <= 0.2.1 - Stored XSS via CSRF
- CVE-2024-6711 Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS
- CVE-2024-6710 Ditty < 3.1.45 - Author+ Stored XSS
- CVE-2024-6709 Sync Post With Other Site <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update
- CVE-2024-6708 Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
- CVE-2024-6707 Open WebUI Arbitrary File Upload + Path Traversal
- CVE-2024-6706 Open WebUI Stored Cross-Site Scripting
- CVE-2024-6705 RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-6704 Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection
- CVE-2024-6703 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-6702 Cross-site scripting in Pega Infinity
- CVE-2024-6701 Cross-site scripting in Pega Infinity
- CVE-2024-6700 Cross-site scripting in Pega Infinity
- CVE-2024-6699 SQLi in Mikafon Electronic's Mikafon MA7
- CVE-2024-6698 FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation
- CVE-2024-6697 Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges
- CVE-2024-6696 Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control
- CVE-2024-6695 profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
- CVE-2024-6694 WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure
- CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS
- CVE-2024-6692 Cross-site scripting in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CVE-2024-6691 Cross-site scripting in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CVE-2024-6690 WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
- CVE-2024-6689 Local privilege escalation vulnerability in baramundi Management Agent via MSI Installer
- CVE-2024-6688 Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update
- CVE-2024-6687 CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory
- CVE-2024-6685 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2024-6684 Authentication Bypass in GST Electronics' inohom Nova Panel N7
- CVE-2024-6681 witmy my-springsecurity-plus dept sql injection
- CVE-2024-6680 witmy my-springsecurity-plus build sql injection
- CVE-2024-6679 witmy my-springsecurity-plus role sql injection
- CVE-2024-6678 Authentication Bypass by Spoofing in GitLab
- CVE-2024-6677 Privilege escalation in uberAgent
- CVE-2024-6676 witmy my-springsecurity-plus user sql injection
- CVE-2024-6675 Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File
- CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui
- CVE-2024-6673 CSRF Vulnerability in parisneo/lollms-webui
- CVE-2024-6672 WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability
- CVE-2024-6671 WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
- CVE-2024-6670 Progress WhatsUp Gold SQL Injection
- CVE-2024-6669 AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-6668 profilepro <= 1.3 - Subscriber+ Stored Cross Site Scripting
- CVE-2024-6667 kbucket < 4.1.5 - Reflected XSS
- CVE-2024-6666 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id
- CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS
- CVE-2024-6662 CSRF in MegaBIP
- CVE-2024-6661 ParityPress <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-6660 Missing authorization in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- CVE-2024-6658 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.
- CVE-2024-6657 BLE peripheral DoS after few cycles of connect/disconnects
- CVE-2024-6656 Hardcoded Credentals in TNB Mobile Solutions' Cockpit Software
- CVE-2024-6655 Gtk3: gtk2: library injection from cwd
- CVE-2024-6654 Denial of Service vulnerability in ESET products for macOS
- CVE-2024-6653 code-projects Simple Task List Login loginForm.php sql injection
- CVE-2024-6652 itsourcecode Gym Management System manage_member.php sql injection
- CVE-2024-6651 WordPress File Upload < 4.24.8 - Reflected XSS
- CVE-2024-6650 SourceCodester Employee and Visitor Gate Pass Logging System Master.php save_designation cross site scripting
- CVE-2024-6649 SourceCodester Employee and Visitor Gate Pass Logging System Users.php save_users cross-site request forgery
- CVE-2024-6648 Path Traversal in AP Page Builder
- CVE-2024-6647 Croogo Setting Theme unrestricted upload
- CVE-2024-6646 Netgear WN604 Web Interface downloadFile.php information disclosure
- CVE-2024-6645 WuKongOpenSource Wukong_nocode AviatorScript ExpressionUtil.java deserialization
- CVE-2024-6644 zmops ArgusDBM AviatorScript CalculateAlarm.java getDefaultClassLoader deserialization
- CVE-2024-6641 WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration
- CVE-2024-6640 pf incorrectly matches different ICMPv6 states in the state table
- CVE-2024-6639 MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode
- CVE-2024-6638 Integer Overflow Vulnerability Reading TDMS Files in LabVIEW
- CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
- CVE-2024-6636 WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
- CVE-2024-6635 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
- CVE-2024-6634 Cross-site scripting in Master Currency WP
- CVE-2024-6633 Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)
- CVE-2024-6632 SQL Injection in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)
- CVE-2024-6631 ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions
- CVE-2024-6629 All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode
- CVE-2024-6628 EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery
- CVE-2024-6627 Happy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget
- CVE-2024-6626 EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization
- CVE-2024-6625 WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter
- CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
- CVE-2024-6621 WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
- CVE-2024-6620 Cross-site scripting in PC42t, PC42tp, and PC42d (Common Firmware)
- CVE-2024-6619 Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report
- CVE-2024-6618 Path Traversal in Ocean Data Systems Dream Report
- CVE-2024-6617 NinjaTeam Header Footer Custom Code <= 1.2 - Admin+ Stored XSS via CSS Styles
- CVE-2024-6615 Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- CVE-2024-6614 Incorrect listing of stack frames
- CVE-2024-6613 Incorrect listing of stack frames
- CVE-2024-6612 CSP violation leakage when using devtools
- CVE-2024-6611 Incorrect handling of SameSite cookies
- CVE-2024-6610 Form validation popups could block exiting full-screen mode
- CVE-2024-6609 Memory corruption in NSS
- CVE-2024-6608 Cursor could be moved out of the viewport using pointerlock.