Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 190 of 521.
- CVE-2024-56219 WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability
- CVE-2024-56218 WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-56217 WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability
- CVE-2024-56216 WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability
- CVE-2024-56215 WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability
- CVE-2024-56214 WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability
- CVE-2024-56213 WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability
- CVE-2024-56212 WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability
- CVE-2024-56211 WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability
- CVE-2024-56210 WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-56209 WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-56208 WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-56207 Cross-site request forgery in EditionGuard for WooCommerce – eBook Sales with DRM
- CVE-2024-56206 WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerability
- CVE-2024-56205 WordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability
- CVE-2024-56204 WordPress Sinking Dropdowns plugin <= 1.25 - CSRF to Privilege Escalation vulnerability
- CVE-2024-56203 WordPress Wayne Audio Player plugin <= 1.0 - CSRF to Privilege Escalation vulnerability
- CVE-2024-56202 Apache Traffic Server: Expect header field can unreasonably retain resource
- CVE-2024-56201 Jinja has a sandbox breakout through malicious filenames
- CVE-2024-56200 Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy
- CVE-2024-5620 Authentication Bypass in PruvaSoft Informatics' Apinizer Management Console
- CVE-2024-56199 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
- CVE-2024-56198 path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
- CVE-2024-56197 Users can see other user's tagged PMs in Discourse
- CVE-2024-56196 Apache Traffic Server: ACL is not fully compatible with older versions
- CVE-2024-56195 Apache Traffic Server: Intercept plugins are not access controlled
- CVE-2024-56193 Information disclosure in Android
- CVE-2024-56192 Memory corruption in Android
- CVE-2024-56191 Integer overflow in Android
- CVE-2024-56190 Memory corruption in Android
- CVE-2024-5619 IDOR in PruvaSoft Informatics' Apinizer Management Console
- CVE-2024-56189 Memory corruption in Android
- CVE-2024-56188 Null dereference in Android
- CVE-2024-56187 Information disclosure in Android
- CVE-2024-56186 Memory corruption in Android
- CVE-2024-56185 Memory corruption in Android
- CVE-2024-56184 Memory corruption in Android
- CVE-2024-56182 Security feature bypass in SIMATIC Field PG M5
- CVE-2024-56181 Security feature bypass in SIMATIC Field PG M5
- CVE-2024-56180 Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
- CVE-2024-5618 Broken Access Control in PruvaSoft Informatics' Apinizer Management Console
- CVE-2024-56179 In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via dire
- CVE-2024-56178 Privilege escalation in couchbase:couchbase server
- CVE-2024-56175 Cross-site scripting in optimizely:configured commerce
- CVE-2024-56174 Cross-site scripting in optimizely:configured commerce
- CVE-2024-56173 Cross-site scripting in optimizely:configured commerce
- CVE-2024-56171 Use after free in libxml2
- CVE-2024-56170 Security feature bypass in nicmx:fort-validator
- CVE-2024-56169 Security feature bypass in nicmx:fort validator
- CVE-2024-56161 Security feature bypass in AMD EPYC™ 7001 Series
- CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI
- CVE-2024-56159 Server source code is exposed to the public if sourcemaps are enabled
- CVE-2024-56158 XWiki allows SQL injection in query endpoint of REST API with Oracle
- CVE-2024-56157 iTop vulnerable to Self XSS in CSV Import
- CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
- CVE-2024-5615 Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure
- CVE-2024-56145 Craft CMS Code Injection
- CVE-2024-56144 Stored XSS-LibreNMS-Display Name 2 in librenms
- CVE-2024-56143 Strapi Allows Unauthorized Access to Private Fields via parms.lookup
- CVE-2024-56142 Path Traversal in pghoard
- CVE-2024-56141 Minosoft has IV equal to key
- CVE-2024-56140 Bypass of CSRF Middleware in Astro
- CVE-2024-5614 Piotnet Addons For Elementor <= 2.4.29 - Unauthenticated Sensitive Information Exposure
- CVE-2024-56139 A stack overflow Segmentation Fault (SEGV) and Memory Leak in pdftools
- CVE-2024-56138 Timestamp signature generation lacks certificate revocation check in notion-go
- CVE-2024-56137 MaxKB RCE vulnerability in function library
- CVE-2024-56136 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server
- CVE-2024-56135 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56134 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56133 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56132 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56131 Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-5613 Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action
- CVE-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
- CVE-2024-5612 Cross-site scripting in Essential Addons for Elementor Pro
- CVE-2024-56116 Cross-site request forgery in amiro:amiro.cms
- CVE-2024-56115 Cross-site scripting in amiro:amiro.cms
- CVE-2024-56114 Missing authorization in henkel:canlineapp
- CVE-2024-56113 Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django se
- CVE-2024-56112 Cross-site scripting in cyberpanel:cyberpanel
- CVE-2024-5611 Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- CVE-2024-56089 Weak cryptography in technitium:dnsserver
- CVE-2024-56087 Code injection in logpoint:siem
- CVE-2024-56086 Command injection in logpoint:siem
- CVE-2024-56085 Code injection in logpoint:siem
- CVE-2024-56084 Command injection in logpoint:universal normalizer
- CVE-2024-56083 Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.de
- CVE-2024-56082 ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true.
- CVE-2024-5608 SQL Injection
- CVE-2024-56074 gitingest before 9996a06 mishandles symbolic links that point outside of the base directory.
- CVE-2024-56073 Denial of service in pavel-odintsov:fastnetmon
- CVE-2024-56072 Denial of service in pavel-odintsov:fastnetmon
- CVE-2024-56071 WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability
- CVE-2024-56070 WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities
- CVE-2024-5607 Missing authorization in GDPR CCPA Compliance & Cookie Consent Banner
- CVE-2024-56069 WordPress WP SuperBackup plugin <= 2.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-56068 WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability
- CVE-2024-56067 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability
- CVE-2024-56066 WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerability
- CVE-2024-56065 WordPress WP2LEADS Plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability