Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 168 of 521.
- CVE-2024-6607 Leaving pointerlock by pressing the escape key could be prevented
- CVE-2024-6606 Out-of-bounds read in clipboard component
- CVE-2024-6605 Firefox Android missed activation delay to prevent tapjacking
- CVE-2024-6604 Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13
- CVE-2024-6603 Memory corruption in thread creation
- CVE-2024-6602 Memory corruption in NSS
- CVE-2024-6601 Race condition in permission assignment
- CVE-2024-6600 Memory corruption in WebGL API
- CVE-2024-6599 Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification
- CVE-2024-6598 Denial-of-service on KNIME Business Hub when certain jobs are executed
- CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection
- CVE-2024-6595 Uncontrolled Search Path Element in GitLab
- CVE-2024-6594 WatchGuard Firebox Single Sign-On Client Denial-of-Service
- CVE-2024-6593 WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass
- CVE-2024-6592 WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
- CVE-2024-6591 Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation
- CVE-2024-6590 Missing authorization in WPGSI: Spreadsheet Integration
- CVE-2024-6589 LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-6588 Cross-site scripting in PowerPress Podcasting plugin by Blubrry
- CVE-2024-6587 SSRF in berriai/litellm
- CVE-2024-6586 Server-side request forgery in Lightdash
- CVE-2024-6585 Cross-site scripting in Lightdash
- CVE-2024-6584 Jetpack Boost < 3.4.7 - Admin+ SSRF
- CVE-2024-6583 Path Traversal in stangirard/quivr
- CVE-2024-6582 Broken Access Control in lunary-ai/lunary
- CVE-2024-6581 Remote Code Execution due to Stored XSS in parisneo/lollms
- CVE-2024-6580 /n software IPWorks SSH insufficient file access verification
- CVE-2024-6579 Missing authorization in Web and WooCommerce Addons for WPBakery Builder
- CVE-2024-6578 Stored XSS in aimhubio/aim
- CVE-2024-6577 Unclaimed S3 Bucket Usage in pytorch/serve
- CVE-2024-6576 MOVEit Transfer Privilege Escalation Vulnerability
- CVE-2024-6575 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-6574 Laposta <= 1.12 - Unauthenticated Full Path Disclosure
- CVE-2024-6573 Intelligence <= 1.4.0 - Unauthenticated Full Path Disclosure
- CVE-2024-6572 Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'
- CVE-2024-6571 Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6570 Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure
- CVE-2024-6569 Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure
- CVE-2024-6568 Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure
- CVE-2024-6567 Ebook Store <= 5.8001 - Unauthenticated Full Path Disclosure
- CVE-2024-6566 Aramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path Disclosure
- CVE-2024-6565 AForms <= 2.2.6 - Unauthenticated Full Path Disclosure
- CVE-2024-6564 Buffer overflow in Rensas RCAR
- CVE-2024-6563 Buffer Overflow Arbitrary Write
- CVE-2024-6562 affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure
- CVE-2024-6560 Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure
- CVE-2024-6559 XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
- CVE-2024-6558 HMS Industrial Networks Anybus-CompactCom 30 Cross-site Scripting
- CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure
- CVE-2024-6556 SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure
- CVE-2024-6555 WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6554 Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure
- CVE-2024-6553 WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure
- CVE-2024-6552 Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure
- CVE-2024-6551 GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6550 Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6549 Admin Post Navigation <= 2.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6548 Add Admin JavaScript <= 2.0 - Unauthenticated Full Path Dislcosure
- CVE-2024-6547 Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure
- CVE-2024-6546 One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6545 Admin Trim Interface <= 3.5.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6544 Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosure
- CVE-2024-6542 Livestatus injection in mknotifyd
- CVE-2024-6541 Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
- CVE-2024-6540 Information exlosure in external interface
- CVE-2024-6539 heyewei SpringBootCMS Guestbook guestbook cross site scripting
- CVE-2024-6538 Openshift-console: openshift console: server-side request forgery
- CVE-2024-6536 Zephyr Project Manager < 3.3.99 - Editor+ XSS
- CVE-2024-6535 Skupper: potential authentication bypass to skupper console via forged cookies
- CVE-2024-6534 Directus 10.13.0 - Insecure object reference via PATH presets
- CVE-2024-6533 Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
- CVE-2024-6532 Cross-site scripting in Sheet to Table Live Sync for Google Sheet
- CVE-2024-6530 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-6529 Ultimate Classified Listings < 1.4 - Reflected XSS
- CVE-2024-6528 Cross-site scripting in Modicon Controllers M241 / M251
- CVE-2024-6527 SQL Injection in MegaBIP
- CVE-2024-6526 CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting
- CVE-2024-6525 D-Link DAR-7000 decodmail.php deserialization
- CVE-2024-6524 ShopXO Uploader.php server-side request forgery
- CVE-2024-6523 ZKTeco BioTime system-group-add cross site scripting
- CVE-2024-6522 Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery
- CVE-2024-6521 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-6520 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-6519 Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability
- CVE-2024-6518 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-6517 Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS
- CVE-2024-6516 Cross Site Scripting XSS
- CVE-2024-6515 unauthorized file access
- CVE-2024-6512 Missing authorization in Devolutions Server
- CVE-2024-6511 y_project RuoYi Content-Type isJsonRequest cross site scripting
- CVE-2024-6510 Local privilege escalation vulnerability in AVG Internet Security
- CVE-2024-6509 Denial of service in AXIS OS
- CVE-2024-6508 Openshift-console: oauth2 insufficient state parameter entropy
- CVE-2024-6507 Deep Lake Kaggle command injection
- CVE-2024-6506 Information exposure vulnerability in the MRW plug-in
- CVE-2024-6505 Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss
- CVE-2024-6504 Rapid7 InsightVM Protection Mechanism Failure
- CVE-2024-6502 Incorrect Provision of Specified Functionality in GitLab
- CVE-2024-6501 Networkmanager: denial of service
- CVE-2024-6500 Missing authorization in InPost PL