Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 175 of 521.
- CVE-2024-5855 Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion
- CVE-2024-5853 Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-5852 WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal
- CVE-2024-5851 playSMS SMS Schedule cross site scripting
- CVE-2024-5849 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS
- CVE-2024-5848 Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation
- CVE-2024-5847 Use after free in Chrome
- CVE-2024-5846 Use after free in Chrome
- CVE-2024-5845 Use after free in Chrome
- CVE-2024-5844 Memory corruption in Chrome
- CVE-2024-5843 Security feature bypass in Chrome
- CVE-2024-5842 Use after free in Chrome
- CVE-2024-5841 Use after free in Chrome
- CVE-2024-58400 llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
- CVE-2024-5840 Security feature bypass in Chrome
- CVE-2024-58399 llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
- CVE-2024-58398 Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
- CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
- CVE-2024-58396 YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
- CVE-2024-58394 Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying
- CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
- CVE-2024-58392 PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint
- CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters
- CVE-2024-58390 Frappe before 15.41.0 Privilege Escalation via Document Action
- CVE-2024-5839 Memory corruption in Chrome
- CVE-2024-58389 HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
- CVE-2024-58388 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
- CVE-2024-58387 Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
- CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
- CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
- CVE-2024-58384 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
- CVE-2024-58383 Froxlor before 2.2.0 Insecure File Permissions mysql.conf
- CVE-2024-58382 league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
- CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
- CVE-2024-58380 PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
- CVE-2024-5838 Memory corruption in Chrome
- CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
- CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
- CVE-2024-58375 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation
- CVE-2024-58374 Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree
- CVE-2024-58370 SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service
- CVE-2024-5837 Memory corruption in Chrome
- CVE-2024-58369 SurrealDB before 1.1.1 Denial of Service via Global Parameters
- CVE-2024-58368 SurrealDB before 1.1.0 Denial of Service via HTTP Headers
- CVE-2024-58367 SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions
- CVE-2024-58366 SurrealDB before 1.1.1 Format String via Scripting Functions
- CVE-2024-58365 SurrealDB before 1.2.0 Denial of Service via Nonexistent Function
- CVE-2024-58364 SurrealDB before 1.2.1 Denial of Service via Parsing Error
- CVE-2024-58363 SurrealDB before 1.5.4 Authentication Bypass via Database Switch
- CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API
- CVE-2024-58361 SurrealDB before 2.0.4 Denial of Service via Parser Exception
- CVE-2024-58360 stoatchat before 0.7.8 Unrestricted Account Creation
- CVE-2024-5836 Code injection in Chrome
- CVE-2024-58359 SurrealDB before 2.1.0 Denial of Service via rand() Sorting
- CVE-2024-58358 SurrealDB before 2.1.0 Denial of Service via Nonexistent Role
- CVE-2024-58357 SurrealDB before 2.1.0 Denial of Service via rand::time()
- CVE-2024-58356 SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
- CVE-2024-58355 Cal.com through 4.7.15 Cross-Site Scripting via booking questions
- CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
- CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions
- CVE-2024-58352 Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
- CVE-2024-58351 Flowise - Remote Code Execution via overrideConfig Parameter
- CVE-2024-58350 Ghidra < 11.2 - Use After Free in Sleigh Backend via Static Initialization Order
- CVE-2024-5835 Memory corruption in Chrome
- CVE-2024-58349 WordPress Theme Travelscape 1.0.3 Arbitrary File Upload
- CVE-2024-58348 WordPress Background Image Cropper 1.2 Remote Code Execution
- CVE-2024-58344 Carbon Forum 5.9.0 Persistent XSS via Forum Name Field
- CVE-2024-58343 Auth bypass in Helpdesk
- CVE-2024-58342 XenForo Open Redirect via getDynamicRedirect
- CVE-2024-58341 OpenCart Core 4.0.2.3 SQL Injection via search Parameter
- CVE-2024-58340 LangChain <= 0.3.1 MRKLOutputParser ReDoS
- CVE-2024-5834 Code injection in Chrome
- CVE-2024-58339 LlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustion
- CVE-2024-58338 Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command
- CVE-2024-58337 Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI
- CVE-2024-58336 Akuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure
- CVE-2024-58335 XML external entity in OpenXRechnungToolbox
- CVE-2024-58330 Missing authorization in Camera Firmware
- CVE-2024-5833 Memory corruption in Chrome
- CVE-2024-58323 Kentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS
- CVE-2024-58322 Kentico Xperience <= 13.0.158 Shipping Options Stored XSS
- CVE-2024-58321 Kentico Xperience <= 13.0.159 Form Validation Stored XSS
- CVE-2024-58320 Kentico Xperience <= 13.0.159 Authentication Information Disclosure
- CVE-2024-5832 Use after free in Chrome
- CVE-2024-58319 Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS
- CVE-2024-58318 Kentico Xperience <= 13.0.162 Rich Text Editor Stored XSS
- CVE-2024-58317 Kentico Xperience <= 13.0.164 Cookie Security Configuration
- CVE-2024-58316 Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter
- CVE-2024-58315 Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path
- CVE-2024-58314 Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI
- CVE-2024-58313 xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature
- CVE-2024-58312 xbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php
- CVE-2024-58311 Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness
- CVE-2024-58310 APC Network Management Card 4 Path Traversal via Directory Traversal
- CVE-2024-5831 Use after free in Chrome
- CVE-2024-58309 xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php
- CVE-2024-58308 Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login
- CVE-2024-58307 CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint
- CVE-2024-58306 minaliC 2.0.0 Denial of Service Vulnerability via Large GET Request
- CVE-2024-58305 WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation