Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 183 of 521.
- CVE-2024-5714 Improper Access Control in lunary-ai/lunary
- CVE-2024-5713 if-so < 1.8.0.4 - Reflected XSS
- CVE-2024-5712 CSRF Vulnerability in stitionai/devika
- CVE-2024-5711 Stored XSS in stitionai/devika
- CVE-2024-5710 Improper Access Control in Team Management in berriai/litellm
- CVE-2024-57099 Code injection in classcms:classcms
- CVE-2024-57098 SQL injection in deep-project:moss
- CVE-2024-57097 Cross-site scripting in classcms:classcms
- CVE-2024-57096 Information disclosure in kingsoft:wps office
- CVE-2024-57095 SQL injection in go-admin:go-cms
- CVE-2024-5709 WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion
- CVE-2024-57086 node-opcua-alarm-condition prototype pollution vulnerability
- CVE-2024-57085 @stryker-mutator/util vulnerable to Prototype Pollution
- CVE-2024-57084 A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57083 Redoc Prototype Pollution via `Module.mergeObjects` Component
- CVE-2024-57082 @rpldy/uploader prototype pollution
- CVE-2024-57081 A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via sup
- CVE-2024-57080 vxe-table prototype pollution
- CVE-2024-5708 WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-57079 @zag-js/core prototype pollution
- CVE-2024-57078 A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57077 utils-extend Prototype Pollution
- CVE-2024-57076 A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57075 eazy-logger prototype pollution
- CVE-2024-57074 A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57072 module-from-string prototype pollution
- CVE-2024-57071 A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57069 A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57068 @tanstack/form-core prototype pollution
- CVE-2024-57067 A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57066 @ndhoule/defaults prototype pollution
- CVE-2024-57065 A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57064 A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS
- CVE-2024-57063 A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CVE-2024-57062 Privilege escalation in soundcloud:soundcloud
- CVE-2024-57061 An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electro
- CVE-2024-5706 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
- CVE-2024-57056 Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could b
- CVE-2024-57055 Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain serv
- CVE-2024-57052 Auth bypass in youdiancms:youdiancms
- CVE-2024-5705 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
- CVE-2024-57046 Auth bypass in netgear:dgn2200 firmware
- CVE-2024-57045 Auth bypass in dlink:dir-859 a3 firmware
- CVE-2024-57041 NodeBB Cross-site scripting (XSS) vulnerability
- CVE-2024-57040 Hardcoded credentials in tp-link:tl-wr845n firmware
- CVE-2024-5704 Missing authorization in Happy WooCommerce FAQs – Ultimate Product FAQ Plugin
- CVE-2024-57036 Command injection in totolink:a810r firmware
- CVE-2024-57035 SQL injection in wegia:wegia
- CVE-2024-57034 SQL injection in wegia:wegia
- CVE-2024-57033 Cross-site scripting in wegia:wegia
- CVE-2024-57032 Auth bypass in wegia:wegia
- CVE-2024-57031 SQL injection in wegia:wegia
- CVE-2024-57030 Cross-site scripting in wegia:wegia
- CVE-2024-5703 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization
- CVE-2024-57026 Cross-site scripting in tawk:tawk.to
- CVE-2024-57025 Command injection in totolink:x5000r firmware
- CVE-2024-57024 Command injection in totolink:x5000r firmware
- CVE-2024-57023 Command injection in totolink:x5000r firmware
- CVE-2024-57022 Command injection in totolink:x5000r firmware
- CVE-2024-57021 Command injection in totolink:x5000r firmware
- CVE-2024-57020 Command injection in totolink:x5000r firmware
- CVE-2024-5702 Use after free in Firefox
- CVE-2024-57019 Command injection in totolink:x5000r firmware
- CVE-2024-57018 Command injection in totolink:x5000r firmware
- CVE-2024-57017 Command injection in totolink:x5000r firmware
- CVE-2024-57016 Command injection in totolink:x5000r firmware
- CVE-2024-57015 Command injection in totolink:x5000r firmware
- CVE-2024-57014 Command injection in totolink:x5000r firmware
- CVE-2024-57013 Command injection in totolink:x5000r firmware
- CVE-2024-57012 Command injection in totolink:x5000r firmware
- CVE-2024-57011 Command injection in totolink:x5000r firmware
- CVE-2024-5701 Memory corruption in Firefox
- CVE-2024-57004 Cross-site scripting in roundcube:webmail
- CVE-2024-5700 Memory corruption in Firefox
- CVE-2024-56998 Cross-site scripting in phpgurukul:hospital management system
- CVE-2024-56997 Cross-site scripting in phpgurukul:hospital management system
- CVE-2024-56990 Cross-site scripting in phpgurukul:hospital management system
- CVE-2024-5699 Security feature bypass in Firefox
- CVE-2024-5698 Other in Firefox
- CVE-2024-56975 File upload in invoiceplane:invoiceplane
- CVE-2024-56973 Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary
- CVE-2024-56972 An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56971 An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive
- CVE-2024-5697 Information disclosure in Firefox
- CVE-2024-56969 An issue in Pixocial Technology (Singapore) Pte.
- CVE-2024-56968 An issue in Shenzhen Intellirocks Tech Co.
- CVE-2024-56967 An issue in Cloud Whale Interactive Technology LLC.
- CVE-2024-56966 An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitiv
- CVE-2024-56965 An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56964 An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user infor
- CVE-2024-56963 An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via s
- CVE-2024-56962 An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56960 An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information v
- CVE-2024-5696 Memory corruption in Firefox
- CVE-2024-56959 An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56957 An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via su
- CVE-2024-56955 An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.
- CVE-2024-56954 An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information v
- CVE-2024-56953 An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link.
- CVE-2024-56952 An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information