Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 172 of 521.
- CVE-2024-6180 EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
- CVE-2024-6179 XSS vulnerability in LG SuperSign CMS
- CVE-2024-6178 XSS vulnerability in LG SuperSign CMS
- CVE-2024-6177 XSS vulnerability in LG SuperSign CMS
- CVE-2024-6176 Port scanning vulnerability in LG SuperSign CMS
- CVE-2024-6175 Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates
- CVE-2024-6174 Hardcoded credentials in cloud-init
- CVE-2024-6173 Denial of service in AXIS OS
- CVE-2024-6172 SQL injection in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
- CVE-2024-6171 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass
- CVE-2024-6170 Cross-site scripting in Unlimited Elements For Elementor
- CVE-2024-6169 Cross-site scripting in Unlimited Elements For Elementor
- CVE-2024-6168 Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions
- CVE-2024-6167 Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions
- CVE-2024-6166 SQL injection in Unlimited Elements For Elementor
- CVE-2024-6165 WANotifier < 2.6.1 - Admin+ Stored XSS
- CVE-2024-6164 Filter & Grids < 2.8.33 - Unauthenticated LFI
- CVE-2024-6163 local IP restriction of internal HTTP endpoints
- CVE-2024-6162 Undertow: url-encoded request path information can be broken on ajp-listener
- CVE-2024-6161 Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-6160 SQL Injection in MegaBIP
- CVE-2024-6159 Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
- CVE-2024-6158 Category Posts Widget (Free < 4.9.17, Pro < 4.9.13) - Admin+ Stored XSS
- CVE-2024-6157 Null dereference in RobotWare 6
- CVE-2024-6156 lxd CA certificate sign check bypass
- CVE-2024-6155 Server-side request forgery in Greenshift – animation and page builder blocks
- CVE-2024-6154 Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
- CVE-2024-6153 Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability
- CVE-2024-6152 Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-6151 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
- CVE-2024-6150 Missing authorization in Citrix Provisioning
- CVE-2024-6149 Open redirect in Citrix Workspace app for HTML5
- CVE-2024-6148 Security feature bypass in Citrix Workspace app for HTML5
- CVE-2024-6147 Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability
- CVE-2024-6146 Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-6145 Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability
- CVE-2024-6144 Actiontec WCB6200Q Multipart Boundary Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-6143 Actiontec WCB6200Q uh_tcp_recv_header Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-6142 Actiontec WCB6200Q uh_tcp_recv_content Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-6141 Windscribe Directory Traversal Local Privilege Escalation Vulnerability
- CVE-2024-6139 Path Traversal in parisneo/lollms
- CVE-2024-6138 Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSS
- CVE-2024-6137 BT: Classic: SDP OOB access in get_att_search_list
- CVE-2024-6136 WP eStore < 8.5.6 - Settings Reset via CSRF
- CVE-2024-6135 BT:Classic: Multiple missing buf length checks
- CVE-2024-6134 WP eStore < 8.5.6 - Reflected XSS in Product Editing
- CVE-2024-6133 WP eStore < 8.5.6 - Reflected XSS in Customer Search
- CVE-2024-6132 Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-6130 Form Maker by 10Web < 1.15.26 - Admin+ Stored XSS
- CVE-2024-6129 spa-cartcms Username login observable behavioral discrepancy
- CVE-2024-6128 spa-cartcms Checkout Page checkout behavioral workflow
- CVE-2024-6127 BC Security Empire Path Traversal RCE
- CVE-2024-6126 Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option
- CVE-2024-6125 Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism
- CVE-2024-6124 Reflected XSS in Hubshare via Open Redirect
- CVE-2024-6123 Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-6122 Incorrect Default Directory Permissions for NI SystemLink Redis Service
- CVE-2024-6121 NI SystemLink Server Ships Out of Date Redis Version
- CVE-2024-6120 Missing authorization in Sparkle Demo Importer
- CVE-2024-6119 Possible denial of service in X.509 name checks
- CVE-2024-6118 Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password
- CVE-2024-6117 Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous Type
- CVE-2024-6116 itsourcecode Simple Online Hotel Reservation System edit_room.php unrestricted upload
- CVE-2024-6115 itsourcecode Simple Online Hotel Reservation System add_room.php unrestricted upload
- CVE-2024-6114 itsourcecode Monbela Tourist Inn Online Reservation System controller.php unrestricted upload
- CVE-2024-6113 itsourcecode Monbela Tourist Inn Online Reservation System login.php sql injection
- CVE-2024-6112 itsourcecode Pool of Bethesda Online Reservation System index.php sql injection
- CVE-2024-6111 itsourcecode Pool of Bethesda Online Reservation System login.php sql injection
- CVE-2024-6110 itsourcecode Magbanua Beach Resort Online Reservation System controller.php unrestricted upload
- CVE-2024-6109 itsourcecode Tailoring Management System addmeasurement.php sql injection
- CVE-2024-6108 Genexis Tilgin Home Gateway Login cross site scripting
- CVE-2024-6107 Auth bypass in MAAS
- CVE-2024-6104 go-retryablehttp can leak basic auth credentials to log files
- CVE-2024-6103 Use after free in Chrome
- CVE-2024-6102 Memory corruption in Chrome
- CVE-2024-6101 Memory corruption in Chrome
- CVE-2024-6100 Memory corruption in Chrome
- CVE-2024-6099 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
- CVE-2024-6098 PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
- CVE-2024-6097 Absolute Path Traversal Vulnerability
- CVE-2024-6096 Unsafe Deserialization Vulnerability
- CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
- CVE-2024-6094 WP ULike < 4.7.1 - Admin+ Stored XSS
- CVE-2024-6091 Shell Command Denylist Bypass in significant-gravitas/autogpt
- CVE-2024-6090 Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgpt
- CVE-2024-6089 Rockwell Automation Major nonrecoverable fault in 5015 – AENFTXT
- CVE-2024-6088 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
- CVE-2024-6087 Improper Access Control in lunary-ai/lunary
- CVE-2024-6086 Improper Access Control in lunary-ai/lunary
- CVE-2024-6085 Path Traversal in parisneo/lollms
- CVE-2024-6084 itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload
- CVE-2024-6083 PHPVibe Media Upload Page upload-mp3.php unrestricted upload
- CVE-2024-6082 PHPVibe Global Options Page functionalities.global.php cross site scripting
- CVE-2024-6080 Intelbras InControl incontrolWebcam Service unquoted search path
- CVE-2024-6079 DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™
- CVE-2024-6078 Rockwell Automation Authentication Bypass Vulnerability in DataMosaix™
- CVE-2024-6077 Denial of service in 1756-EN4
- CVE-2024-6076 WP eStore < 8.5.5 - Reflected XSS in Category Editing
- CVE-2024-6075 WP eStore < 8.5.5 - Coupon Deletion via CSRF
- CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing