Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 174 of 521.
- CVE-2024-5966 Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode
- CVE-2024-5965 Mosaic <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5964 Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5963 An unquoted executable path exists in Hitachi Device Manager
- CVE-2024-5962 Cross-site scripting in WSO2 API Manager
- CVE-2024-5961 Reflected XSS in 2ClickPortal
- CVE-2024-5960 Plaintext Storage of a Password in Eliz Software's Panel
- CVE-2024-5959 Stored XSS in Eliz Software's Panel
- CVE-2024-5958 SQLi in Eliz Software's Panel
- CVE-2024-5957 Auth bypass in Intrusion Prevention System (IPS) Manager
- CVE-2024-5956 Auth bypass in Intrusion Prevention System (IPS) Manager
- CVE-2024-5955 Cross-site scripting in ePO Onprem Sp1 Update4
- CVE-2024-5953 389-ds-base: malformed userpassword hash may cause denial of service
- CVE-2024-5952 Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability
- CVE-2024-5951 Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability
- CVE-2024-5950 Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-5949 Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability
- CVE-2024-5948 Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-5947 Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
- CVE-2024-5946 Cross-site scripting in Squelch Tabs and Accordions Shortcodes
- CVE-2024-5945 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- CVE-2024-5943 Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion
- CVE-2024-5942 Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure
- CVE-2024-5941 Missing authorization in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5940 Missing authorization in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5939 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure
- CVE-2024-5938 Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5937 Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode
- CVE-2024-5936 Open Redirect in imartinez/privategpt
- CVE-2024-5935 CSRF Vulnerability in imartinez/privategpt
- CVE-2024-5933 Cross-site Scripting (XSS) in parisneo/lollms-webui
- CVE-2024-5932 Deserialization in GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5931 BT: Unchecked user input in bap_broadcast_assistant
- CVE-2024-5930 VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2024-5929 VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- CVE-2024-5928 VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability
- CVE-2024-5926 Path Traversal in stitionai/devika
- CVE-2024-5925 Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5924 Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability
- CVE-2024-5922 Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5921 GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation
- CVE-2024-5920 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator
- CVE-2024-5919 PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability
- CVE-2024-5918 PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User
- CVE-2024-5917 PAN-OS: Server-Side Request Forgery in WildFire
- CVE-2024-5916 PAN-OS: Cleartext Exposure of External System Secrets
- CVE-2024-5915 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
- CVE-2024-5914 Cortex XSOAR: Command Injection in CommonScripts Pack
- CVE-2024-5913 PAN-OS: Improper Input Validation Vulnerability in PAN-OS
- CVE-2024-5912 Cortex XDR Agent: Improper File Signature Verification Checks
- CVE-2024-5911 PAN-OS: File Upload Vulnerability in the Panorama Web Interface
- CVE-2024-5910 Palo Alto Networks Expedition Missing Authentication
- CVE-2024-5909 Cortex XDR Agent: Local Windows User Can Disable the Agent
- CVE-2024-5908 GlobalProtect App: Encrypted Credential Exposure via Log Files
- CVE-2024-5907 Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability
- CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- CVE-2024-5905 Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent
- CVE-2024-5902 UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter
- CVE-2024-5901 SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
- CVE-2024-5899 Improper trust check in Bazel Build intellij plugin
- CVE-2024-5898 itsourcecode Payroll Management System print_payroll.php sql injection
- CVE-2024-5897 SourceCodester Employee and Visitor Gate Pass Logging System cross site scripting
- CVE-2024-5896 SourceCodester Employee and Visitor Gate Pass Logging System save_users sql injection
- CVE-2024-5895 SourceCodester Employee and Visitor Gate Pass Logging System delete_users sql injection
- CVE-2024-5894 SourceCodester Online Eyewear Shop manage_product.php sql injection
- CVE-2024-5893 SourceCodester Cab Management System sql injection
- CVE-2024-5892 Cross-site scripting in Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme
- CVE-2024-5891 Quay: unauthorized user may authenticate via oauth application token
- CVE-2024-5890 HTML Injection in the Assessment plugin
- CVE-2024-5889 Events Manager <= 6.4.8 - Reflected Cross-Site Scripting
- CVE-2024-5888 Stored XSS in Rest Services API for a Toolbox published as GP Service
- CVE-2024-5885 Server-Side Request Forgery (SSRF) in stangirard/quivr
- CVE-2024-5884 Beauty <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameter
- CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS
- CVE-2024-5882 Ultimate Classified Listings < 1.3 - Unauthenticated LFI
- CVE-2024-5881 Cross-site scripting in Webico Slider Flatsome Addons
- CVE-2024-5880 Hide My Site <= 2.2 - Unauthenticated Information Exposure
- CVE-2024-5879 Cross-site scripting in HubSpot All-In-One Marketing – Forms, Popups, Live Chat
- CVE-2024-5878 Cross-site scripting in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
- CVE-2024-5877 IrfanView PIC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-5876 IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2024-5875 IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-5874 IrfanView PNT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-5872 Other in EOS
- CVE-2024-5871 WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
- CVE-2024-5870 Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5869 Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5868 WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
- CVE-2024-5867 Delicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- CVE-2024-5866 Arbitrary Directory Listing in Centrify PAS
- CVE-2024-5865 Arbitrary File Reading in Centrify PAS
- CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
- CVE-2024-5863 Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance
- CVE-2024-5862 User Enumeration in Mia Technology's Mia-Med Health Aplication
- CVE-2024-5861 WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection
- CVE-2024-5860 Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
- CVE-2024-5859 Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting
- CVE-2024-5858 Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update
- CVE-2024-5857 Missing authorization in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
- CVE-2024-5856 Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion