Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 188 of 521.
- CVE-2024-56449 Privilege escalation in EMUI
- CVE-2024-56448 Missing authorization in EMUI
- CVE-2024-56447 Missing authorization in EMUI
- CVE-2024-56446 Other in HarmonyOS
- CVE-2024-56445 Auth bypass in HarmonyOS
- CVE-2024-56444 Information disclosure in HarmonyOS
- CVE-2024-56443 Information disclosure in HarmonyOS
- CVE-2024-56442 Other in EMUI
- CVE-2024-56441 Race condition in EMUI
- CVE-2024-56440 Missing authorization in EMUI
- CVE-2024-5644 WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders
- CVE-2024-56439 Information disclosure in HarmonyOS
- CVE-2024-56438 Memory corruption in EMUI
- CVE-2024-56437 Other in HarmonyOS
- CVE-2024-56436 Information disclosure in HarmonyOS
- CVE-2024-56435 Information disclosure in HarmonyOS
- CVE-2024-56434 Use after free in EMUI
- CVE-2024-56433 Misconfiguration in shadow-utils
- CVE-2024-56431 Other in xiph:theora
- CVE-2024-56430 Null dereference in OpenFHE
- CVE-2024-56429 Hardcoded credentials in iLabClient
- CVE-2024-56428 Information disclosure in itech-gmbh:ilabclient
- CVE-2024-56427 Memory corruption in samsung:exynos 1080 firmware
- CVE-2024-56426 Memory corruption in samsung:exynos 1080 firmware
- CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()
- CVE-2024-56414 Weak cryptography in Acronis Cyber Protect 16
- CVE-2024-56413 Auth bypass in Acronis Cyber Protect 16
- CVE-2024-56412 PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters
- CVE-2024-56411 PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
- CVE-2024-56410 PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties
- CVE-2024-5641 One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-56409 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file
- CVE-2024-56408 PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
- CVE-2024-56406 Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
- CVE-2024-56404 Privilege escalation in Identity Manager
- CVE-2024-5640 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-5639 User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update
- CVE-2024-5638 Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins
- CVE-2024-56378 Memory corruption in freedesktop:poppler
- CVE-2024-56377 Cross-site scripting in REDCap
- CVE-2024-56376 Cross-site scripting in REDCap
- CVE-2024-56375 Integer overflow in fort-validator
- CVE-2024-56374 Django has a potential denial-of-service vulnerability in IPv6 validation
- CVE-2024-56373 Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information
- CVE-2024-56372 net: tun: fix tun_napi_alloc_frags()
- CVE-2024-56370 Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions
- CVE-2024-5637 Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion
- CVE-2024-56369 drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
- CVE-2024-56368 ring-buffer: Fix overflow in __rb_map_vma
- CVE-2024-56366 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
- CVE-2024-56364 Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx
- CVE-2024-56363 APTRS has SSTI vulnerability
- CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db
- CVE-2024-56361 Stored Cross-Site Scripting (XSS) in lgsl v7.0
- CVE-2024-5636 itsourcecode Bakery Online Ordering System index.php sql injection
- CVE-2024-56359 Cross-site Scripting vulnerability through HyperLink cells in grist-core
- CVE-2024-56358 Cross-site Scripting vulnerability through svg attachment previews in grist-core
- CVE-2024-56357 Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
- CVE-2024-56356 XML external entity in TeamCity
- CVE-2024-56355 Cross-site scripting in TeamCity
- CVE-2024-56354 Information disclosure in TeamCity
- CVE-2024-56353 Information disclosure in TeamCity
- CVE-2024-56352 Cross-site scripting in TeamCity
- CVE-2024-56351 Auth bypass in TeamCity
- CVE-2024-56350 Missing authorization in TeamCity
- CVE-2024-5635 itsourcecode Bakery Online Ordering System index.php sql injection
- CVE-2024-56349 Missing authorization in TeamCity
- CVE-2024-56348 Missing authorization in TeamCity
- CVE-2024-56347 IBM AIX command execution
- CVE-2024-56346 IBM AIX command execution
- CVE-2024-56344 IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities
- CVE-2024-56343 IBM Verify Identity Access Digital Credentials denial of service
- CVE-2024-56342 IBM Verify Identity Access Digital Credentials information disclosure
- CVE-2024-56341 IBM Content Navigator cross-site scripting
- CVE-2024-56340 IBM Cognos Analytics path traversal
- CVE-2024-5634 Weak cryptography in LBH30FE200W
- CVE-2024-56339 IBM WebSphere Application Server information disclosure
- CVE-2024-56338 IBM Sterling B2B Integrator cross-site scripting
- CVE-2024-56337 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
- CVE-2024-56336 Security feature bypass in SINAMICS S200
- CVE-2024-56335 Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden
- CVE-2024-56334 Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
- CVE-2024-56333 Remote code execution in onyxia-api
- CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions
- CVE-2024-56331 Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor
- CVE-2024-56330 Session VNC may be accessed by other sessions on the same host in stardust
- CVE-2024-5633 Auth bypass in LBH30FE200W
- CVE-2024-56329 Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream
- CVE-2024-56328 HTMLi(XSS without CSP) via Onebox urls in Discourse
- CVE-2024-56327 Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage
- CVE-2024-56326 Jinja has a sandbox breakout through indirect reference to format method
- CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
- CVE-2024-56324 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins
- CVE-2024-56323 OpenFGA Authorization Bypass
- CVE-2024-56322 GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality
- CVE-2024-56321 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
- CVE-2024-56320 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user
- CVE-2024-5632 Hardcoded credentials in NVR3608PGE2W
- CVE-2024-56319 Denial of service in Matter