Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 173 of 521.
- CVE-2024-6073 WP eStore < 8.5.5 - Reflected XSS in Discount Editing
- CVE-2024-6072 WP eStore < 8.5.5 - Reflected XSS via $_SERVER['REQUEST_URI']
- CVE-2024-6071 PTC Creo Elements/Direct License Server Missing Authorization
- CVE-2024-6070 if-so < 1.8.0.4 - Admin+ Stored XSS
- CVE-2024-6069 Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
- CVE-2024-6068 Input Validation Vulnerability exists in Arena® Input Analyzer
- CVE-2024-6067 SourceCodester Music Class Enrollment System sql injection
- CVE-2024-6066 SourceCodester Best House Rental Management System payment_report.php sql injection
- CVE-2024-6065 itsourcecode Bakery Online Ordering System index.php sql injection
- CVE-2024-6064 GPAC MP4Box loader_xmt.c xmt_node_end use after free
- CVE-2024-6063 GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference
- CVE-2024-6062 GPAC MP4Box load_text.c swf_svg_add_iso_sample null pointer dereference
- CVE-2024-6061 GPAC MP4Box isoffin_read.c isoffin_process infinite loop
- CVE-2024-6060 Information disclosure in Webscopes
- CVE-2024-6059 Ingenico Estate Manager News Feed messages cross site scripting
- CVE-2024-6058 LabVantage LIMS cross site scripting
- CVE-2024-6057 Auth bypass in Remote Desktop Manager
- CVE-2024-6056 nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy
- CVE-2024-6055 Information disclosure in Remote Desktop Manager
- CVE-2024-6054 Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-6053 Improper access control in the clipboard synchronization feature
- CVE-2024-6052 XSS in SQL check parameters
- CVE-2024-6051 Cross Application Scripting in Redlink SDK
- CVE-2024-6050 Reflected XSS in SOWA OPAC
- CVE-2024-6049 Unauthenticated Path Traversal
- CVE-2024-6048 Openfind MailGates and MailAudit - OS Command Injection
- CVE-2024-6047 GeoVision Devices OS Command Injection
- CVE-2024-6045 D-Link router - Hidden Backdoor
- CVE-2024-6044 D-Link router - Arbitrary File Reading
- CVE-2024-6043 SourceCodester Best House Rental Management System admin_class.php login sql injection
- CVE-2024-6042 itsourcecode Real Estate Management System property-detail.php sql injection
- CVE-2024-6041 itsourcecode Gym Management System manage_user.php sql injection
- CVE-2024-6040 Missing client_id in parisneo/lollms-webui
- CVE-2024-6039 Feng Office Workspaces sql injection
- CVE-2024-6038 ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt
- CVE-2024-6037 Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt
- CVE-2024-6036 Denial of Service in gaizhenbiao/chuanhuchatgpt
- CVE-2024-6035 Stored XSS in gaizhenbiao/chuanhuchatgpt
- CVE-2024-6033 Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2024-6032 Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
- CVE-2024-6031 Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
- CVE-2024-6030 Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability
- CVE-2024-6029 Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability
- CVE-2024-6028 Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
- CVE-2024-6027 Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter
- CVE-2024-6026 Slider by 10Web < 1.2.56 - Editor+ Stored XSS
- CVE-2024-6025 Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSS
- CVE-2024-6024 ContentLock <= 1.0.3 - Groups/Emails Deletion via CSRF
- CVE-2024-6023 ContentLock <= 1.0.3 - Email Adding via CSRF
- CVE-2024-6022 ContentLock <= 1.0.3 - Settings Update via CSRF
- CVE-2024-6021 Donation Block for PayPal <= 2.1.0 - Unauthenticated Stored XSS
- CVE-2024-6020 Sign-up Sheets < 2.2.13 - Reflected XSS
- CVE-2024-6019 Music Request Manager <= 1.3 - Unauthenticated Stored XSS
- CVE-2024-6018 Music Request Manager <= 1.3 - Reflected XSS
- CVE-2024-6017 Music Request Manager <= 1.3 - Stored XSS via CSRF
- CVE-2024-6016 itsourcecode Online Laundry Management System admin_class.php sql injection
- CVE-2024-6015 itsourcecode Online House Rental System manage_user.php sql injection
- CVE-2024-6014 itsourcecode Document Management System edithis.php sql injection
- CVE-2024-6013 itsourcecode Online Book Store admin_delete.php sql injection
- CVE-2024-6012 Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation
- CVE-2024-6011 Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-6010 Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation
- CVE-2024-6009 itsourcecode Event Calendar process.php regDelete sql injection
- CVE-2024-6008 itsourcecode Online Book Store edit_book.php sql injection
- CVE-2024-6007 Netentsec NS-ASG Application Security Gateway deleteiscgwrouteconf.php sql injection
- CVE-2024-6006 ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting
- CVE-2024-6005 ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting
- CVE-2024-6004 Denial of service in Printers
- CVE-2024-6003 Guangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injection
- CVE-2024-6001 Security feature bypass in Accessories and Display Manager
- CVE-2024-6000 FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload
- CVE-2024-5998 Deserialization of Untrusted Data in langchain-ai/langchain
- CVE-2024-5997 Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation
- CVE-2024-5995 Soar Cloud HR Portal - Insufficient Session Expiration
- CVE-2024-5994 WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-5993 Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update
- CVE-2024-5992 Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update
- CVE-2024-5991 Buffer overread in domain name matching
- CVE-2024-5990 ThinManager® ThinServer™ Improper Input Validation Vulnerability
- CVE-2024-5989 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability
- CVE-2024-5988 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability
- CVE-2024-5987 WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
- CVE-2024-5986 Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3
- CVE-2024-5985 SourceCodester Best Online News Portal index.php sql injection
- CVE-2024-5984 itsourcecode Online Bookstore book.php sql injection
- CVE-2024-5983 itsourcecode Online Bookstore bookPerPub.php sql injection
- CVE-2024-5982 Path Traversal in gaizhenbiao/chuanhuchatgpt
- CVE-2024-5981 itsourcecode Online House Rental System manage_user.php sql injection
- CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
- CVE-2024-5979 Denial of Service via Invalid Argument in h2oai/h2o-3
- CVE-2024-5977 Missing authorization in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5976 SourceCodester Employee and Visitor Gate Pass Logging System log_employee sql injection
- CVE-2024-5975 CZ Loan Management <= 1.1 - Unauthenticated SQLi
- CVE-2024-5974 Firebox Authenticated Buffer Overflow Vulnerability
- CVE-2024-5973 MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
- CVE-2024-5971 Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket
- CVE-2024-5970 MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode
- CVE-2024-5969 AIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email Sending
- CVE-2024-5968 Photo Gallery by 10Web <= 1.8.27 - Admin+ Stored XSS
- CVE-2024-5967 Keycloak: leak of configured ldap bind credentials through the keycloak admin console