Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 170 of 521.
- CVE-2024-6387 Openssh: regresshion - race condition in ssh allows rce/dos
- CVE-2024-6386 Code injection in WPML
- CVE-2024-6385 Improper Access Control in GitLab
- CVE-2024-6384 Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
- CVE-2024-6383 MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow
- CVE-2024-6382 Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
- CVE-2024-6381 MongoDB C Driver bson_strfreev may be susceptible to integer overflow
- CVE-2024-6380 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-6379 Cross-site scripting in 3DSwymer
- CVE-2024-6378 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-6377 Open redirect in 3DSwymer
- CVE-2024-6376 ejson shell parser in MongoDB Compass maybe bypassed
- CVE-2024-6375 Missing authorization check may lead to shard key refinement
- CVE-2024-6374 lahirudanushka School Management System Subject Page subject.php cross site scripting
- CVE-2024-6373 itsourcecode Online Food Ordering System addproduct.php unrestricted upload
- CVE-2024-6372 itsourcecode Tailoring Management System customeradd.php sql injection
- CVE-2024-6371 itsourcecode Pool of Bethesda Online Reservation System controller.php sql injection
- CVE-2024-6370 LabVantage LIMS POST Request cross site scripting
- CVE-2024-6369 LabVantage LIMS POST Request cross site scripting
- CVE-2024-6368 LabVantage LIMS POST Request cross site scripting
- CVE-2024-6367 LabVantage LIMS POST Request cross site scripting
- CVE-2024-6366 User Profile Builder < 3.11.8 - Unauthenticated Media Upload
- CVE-2024-6365 Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution
- CVE-2024-6364 Server Identity Validation Bypass in Absolute Persistence®
- CVE-2024-6363 Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode
- CVE-2024-6362 Ultimate Blocks < 3.2.0 - Contributor+ Stored XSS
- CVE-2024-6361 Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product.
- CVE-2024-6360 Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.
- CVE-2024-6359 Privilege escalation vulnerability
- CVE-2024-6358 Incorrect Authorization vulnerability
- CVE-2024-6357 Insecure Direct Object Reference vulnerability
- CVE-2024-6356 Incorrect User Management in GitLab
- CVE-2024-6355 Genexis Tilgin Fiber Home Gateway HG1522 cross site scripting
- CVE-2024-6354 Missing authorization in Remote Desktop Manager
- CVE-2024-6353 Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
- CVE-2024-6352 Malformed packet leads to denial of service in APS layer
- CVE-2024-6351 Malformed packet leads to denial of service in NWK/APS layer
- CVE-2024-6350 EmberZNet malformed MAC layer packet leads to denial of service
- CVE-2024-6348 Predictable seed generation after ECU reset
- CVE-2024-6347 Unauthorized access to ECU functionality
- CVE-2024-6346 Cross-site scripting in Post Grid
- CVE-2024-6345 Remote Code Execution in pypa/setuptools
- CVE-2024-6344 ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
- CVE-2024-6343 Memory corruption in ATP series firmware
- CVE-2024-6342 Command injection in NAS326 firmware
- CVE-2024-6340 Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- CVE-2024-6339 Phlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters
- CVE-2024-6338 FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
- CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server
- CVE-2024-6336 Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure
- CVE-2024-6335 Tracking Code Manager < 2.3.0- Admin+ Stored Cross-Site Scripting
- CVE-2024-6334 Easy Table of Contents < 2.0.67 - Editor+ Stored XSS
- CVE-2024-6333 Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products
- CVE-2024-6332 Missing authorization in Booking for Appointments and Events Calendar – Amelia
- CVE-2024-6331 Injection by Prompt Injection in stitionai/devika
- CVE-2024-6330 GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI
- CVE-2024-6329 Improper Encoding or Escaping of Output in GitLab
- CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass
- CVE-2024-6327 Progress Telerik Report Server Deserialization
- CVE-2024-6326 Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
- CVE-2024-6325 Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
- CVE-2024-6324 Inefficient Algorithmic Complexity in GitLab
- CVE-2024-6323 Improper Isolation or Compartmentalization in GitLab
- CVE-2024-6322 Grafana plugin data sources vulnerable to access control bypass
- CVE-2024-6321 ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-6320 ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-6319 IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'
- CVE-2024-6318 IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'
- CVE-2024-6317 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
- CVE-2024-6316 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-6315 Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-6314 IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload
- CVE-2024-6313 Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload
- CVE-2024-6312 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion
- CVE-2024-6311 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-6310 Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-6309 Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2024-6308 itsourcecode Simple Online Hotel Reservation System index.php sql injection
- CVE-2024-6307 WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
- CVE-2024-6303 Missing Authorization in Conduit
- CVE-2024-6302 Improper Handling of Insufficient Permissions or Privileges in Conduit
- CVE-2024-6301 Origin Validation Error in Conduit
- CVE-2024-6300 Incomplete Cleanup in Conduit
- CVE-2024-6299 Use of a Key Past its Expiration Date in Conduit
- CVE-2024-6298 remote code execution
- CVE-2024-6297 Several WordPress.org Plugins <= Various Versions - Injected Backdoor
- CVE-2024-6296 Cross-site scripting in Stackable – Page Builder Gutenberg Blocks
- CVE-2024-6295 udn News App - Insecure Data Storage
- CVE-2024-6294 udn News App - Sensitive Information Exposure
- CVE-2024-6293 Use after free in Chrome
- CVE-2024-6292 Use after free in Chrome
- CVE-2024-6291 Use after free in Chrome
- CVE-2024-6290 Use after free in Chrome
- CVE-2024-6289 WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
- CVE-2024-6288 Cross-site scripting in Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels
- CVE-2024-6287 Incorrect Address Range Calculations
- CVE-2024-6286 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2024-6285 Integer Underflow in Memory Range Check in Renesas RCAR
- CVE-2024-6284 Improper IPv4 and IPv6 byte order storage in github.com/google/nftables
- CVE-2024-6283 Cross-site scripting in DethemeKit for Elementor