Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 169 of 521.
- CVE-2024-6499 WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure
- CVE-2024-6498 CollectChat < 2.4.4 - Admin+ XSS
- CVE-2024-6497 SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter
- CVE-2024-6496 Light Poll <= 1.0.0 - Polls Deletion via CSRF
- CVE-2024-6495 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-6494 WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
- CVE-2024-6493 NinjaTeam Header Footer Custom Code < 1.2 - Admin+ Stored XSS
- CVE-2024-6492 Information disclosure in Remote Desktop Manager
- CVE-2024-6491 Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update
- CVE-2024-6490 Master Slider – Responsive Touch Slider <= 3.9.10 - CSRF to slider deletion
- CVE-2024-6489 Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update
- CVE-2024-6487 Inline Related Posts < 3.8.0 - Admin+ Stored XSS
- CVE-2024-6486 ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection
- CVE-2024-6485 XSS in Bootstrap button component
- CVE-2024-6483 Arbitrary File/Directory Deletion in aimhubio/aim
- CVE-2024-6482 Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
- CVE-2024-6481 Search Filter Pro < 2.5.18 - Admin+ Stored XSS
- CVE-2024-6480 SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting
- CVE-2024-6479 SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) SQL Injection
- CVE-2024-6478 CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS
- CVE-2024-6477 UsersWP < 1.2.12 - Users Information Disclosure
- CVE-2024-6476 Privilege escalation in AXIS Camera Station
- CVE-2024-6473 DLL Hijacking in Yandex Browser
- CVE-2024-6472 Ability to trust not validated macro signatures removed in high security mode
- CVE-2024-6471 SourceCodester Online Tours & Travels Management sms_setting.php sql injection
- CVE-2024-6470 playSMS Template injection
- CVE-2024-6469 playSMS Template injection
- CVE-2024-6468 Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior
- CVE-2024-6467 BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation
- CVE-2024-6466 Misconfiguration in WebSAM DeploymentManager
- CVE-2024-6465 WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
- CVE-2024-6462 DL Yandex Metrika <= 1.2 - Admin+ Stored XSS
- CVE-2024-6460 Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
- CVE-2024-6459 News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI
- CVE-2024-6458 WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-6457 HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
- CVE-2024-6456 SQL Injection vulnerability in AVEVA Historian Server
- CVE-2024-6455 ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function
- CVE-2024-6453 itsourcecode Farm Management System sql injection
- CVE-2024-6452 linlinjava litemall AdminGoodscontroller.java sql injection
- CVE-2024-6451 AI Engine < 2.5.1 - Admin+ RCE
- CVE-2024-6450 Reflected XSS in HyperView Geoportal Toolkit
- CVE-2024-6449 Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit
- CVE-2024-6448 Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure
- CVE-2024-6447 FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter
- CVE-2024-6446 Business Logic Errors in GitLab
- CVE-2024-6445 Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX
- CVE-2024-6444 Bluetooth: ots: missing buffer length check
- CVE-2024-6443 zephyr: out-of-bound read in utf8_trunc
- CVE-2024-6442 Bluetooth: ASCS Unchecked tailroom of the response buffer
- CVE-2024-6441 ORIPA LoaderXML.java deserialization
- CVE-2024-6440 SourceCodester Home Owners Collection Management System sql injection
- CVE-2024-6439 SourceCodester Home Owners Collection Management System unrestricted upload
- CVE-2024-6438 Hitout Carsale OrderController.java sql injection
- CVE-2024-6437 Security feature bypass in EOS - BGP Flowspec
- CVE-2024-6436 Rockwell Automation Input Validation Vulnerability exists in the SequenceManager™ Server
- CVE-2024-6435 Rockwell Automation Privilege Escalation Vulnerability in Pavilion8®
- CVE-2024-6434 Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
- CVE-2024-6433 Local File Inclusion in stitionai/devika
- CVE-2024-6432 Cross-site scripting in Content Blocks (Custom Post Widget)
- CVE-2024-6431 Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-6429 Content Spoofing in Multiple WSO2 Products via Error Message Injection
- CVE-2024-6428 Limited DoS due to permitting creating users with user-defined IDs
- CVE-2024-6427 Uncontrolled Resource Consumption vulnerability in MESbook
- CVE-2024-6426 Information exposure vulnerability vulnerability in MESbook
- CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook
- CVE-2024-6424 Server-Side Request Forgery vulnerability in MESbook
- CVE-2024-6423 Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
- CVE-2024-6422 Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access
- CVE-2024-6421 Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products
- CVE-2024-6420 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
- CVE-2024-6419 SourceCodester Medicine Tracker System sql injection
- CVE-2024-6418 SourceCodester Medicine Tracker System sql injection
- CVE-2024-6417 SourceCodester Simple Online Bidding System sql injection
- CVE-2024-6416 SeaCMS sql injection
- CVE-2024-6415 Ingenico Estate Manager New Widget cross site scripting
- CVE-2024-6414 Parsec Automation TrakSYS Export Page contentpage direct request
- CVE-2024-6412 HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF
- CVE-2024-6411 Privilege escalation in ProfileGrid – User Profiles, Groups and Communities
- CVE-2024-6410 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
- CVE-2024-6409 Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9
- CVE-2024-6408 Slider by 10Web < 1.2.57 - Editor+ Stored XSS
- CVE-2024-6407 Information disclosure in Wiser Home Controller WHC-5918A
- CVE-2024-6406 Sensetive Data Exposure in Yordam Information Technology's Mobile Library Application
- CVE-2024-6405 Floating Social Buttons <= 1.5 - Cross-Site Request Forgery
- CVE-2024-6403 Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflow
- CVE-2024-6402 Tenda A301 SetOnlineDevName fromSetWirelessRepeat stack-based overflow
- CVE-2024-6401 SQLi in SFS Consulting's InsureE GL
- CVE-2024-6400 Cleartext Storage of Username and Password in Finrota's Netahsilat
- CVE-2024-6398 Information disclosure in Secure Web Gateway
- CVE-2024-6397 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
- CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
- CVE-2024-6395 GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys
- CVE-2024-6394 Local File Inclusion in parisneo/lollms-webui
- CVE-2024-6393 NextGEN Gallery < 3.59.5 - Admin+ Stored XSS
- CVE-2024-6392 Missing authorization in Image Optimizer, Resizer and CDN – Sirv
- CVE-2024-6391 oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode
- CVE-2024-6390 Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS
- CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
- CVE-2024-6388 Information disclosure in Ubuntu Advantage Desktop Pro