Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 192 of 521.
- CVE-2024-55972 WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability
- CVE-2024-55971 SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to ru
- CVE-2024-55970 File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734.
- CVE-2024-5597 Fuji Electric Monitouch V-SFT Type Confusion
- CVE-2024-55969 DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an exter
- CVE-2024-55968 An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.
- CVE-2024-55965 Missing authorization in appsmith:appsmith
- CVE-2024-55964 Code injection in appsmith:appsmith
- CVE-2024-55963 Missing authorization in appsmith:appsmith
- CVE-2024-5596 ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions
- CVE-2024-55959 Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
- CVE-2024-55958 Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS.
- CVE-2024-55957 In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver pac
- CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload
- CVE-2024-55955 Privilege escalation in Trend Micro Deep Security
- CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User
- CVE-2024-55953 Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
- CVE-2024-55952 Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
- CVE-2024-55951 Metabase sandboxed users could see filter values from other sandboxed users
- CVE-2024-55950 Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
- CVE-2024-5595 Essential Blocks < 4.7.0 - Contributor+ Stored XSS
- CVE-2024-55949 Privilege escalation in IAM import API in MinIO
- CVE-2024-55948 Anonymous cache poisoning via XHR requests in Discourse
- CVE-2024-55947 Gogs has a Path Traversal in file update API
- CVE-2024-55946 Playloom Engine Data Storage Vulnerability
- CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3
- CVE-2024-5594 Other in OpenVPN
- CVE-2024-55931 Token stored in session storage
- CVE-2024-55930 Weak default folder permissions
- CVE-2024-55929 Mail spoofing
- CVE-2024-55928 Clear text secrets returned & Remote system secrets in clear text
- CVE-2024-55927 Flawed token generation implementation & Hard-coded key implementation
- CVE-2024-55926 Arbitrary file upload, deletion and read through header manipulation
- CVE-2024-55925 API Security bypass through header manipulation
- CVE-2024-55924 Cross-Site Request Forgery in Scheduler Module in TYPO3
- CVE-2024-55923 Cross-Site Request Forgery in Indexed Search Module in TYPO3
- CVE-2024-55922 Cross-Site Request Forgery in Form Framework Module in TYPO3
- CVE-2024-55921 Cross-Site Request Forgery in Extension Manager Module in TYPO3
- CVE-2024-55920 Cross-Site Request Forgery in Dashboard Module in TYPO3
- CVE-2024-55918 An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl.
- CVE-2024-55917 Privilege escalation in Trend Micro Apex One
- CVE-2024-55916 Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
- CVE-2024-55913 IBM Concert Software path traversal
- CVE-2024-55912 IBM Concert Software information disclosure
- CVE-2024-55910 IBM Concert Software server-side request forgery
- CVE-2024-5591 IBM Jazz Foundation information disclosure
- CVE-2024-55909 IBM Concert Software denial of service
- CVE-2024-55907 IBM Cognos Mobile information disclosure
- CVE-2024-55904 IBM DevOps Deploy / IBM UrbanCode Deploy command injection
- CVE-2024-5590 Netentsec NS-ASG Application Security Gateway JSON Content uploadiscuser.php sql injection
- CVE-2024-55898 IBM i privilege escalation
- CVE-2024-55897 IBM PowerHA SystemMirror for i information disclosure
- CVE-2024-55896 IBM PowerHA SystemMirror for i clickjacking
- CVE-2024-55895 IBM InfoSphere Information Server information disclosure
- CVE-2024-55894 TYPO3 Cross-Site Request Forgery in Backend User Module
- CVE-2024-55893 TYPO3 Cross-Site Request Forgery in Log Module
- CVE-2024-55892 Potential Open Redirect via Parsing Differences in TYPO3
- CVE-2024-55891 Information Disclosure via Exception Handling/Logger in TYPO3
- CVE-2024-55890 D-Tale allows Remote Code Execution through the Custom Filter Input
- CVE-2024-5589 Netentsec NS-ASG Application Security Gateway sql injection
- CVE-2024-55889 phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
- CVE-2024-55888 Content Security Policy appears to be missing in software and production setup
- CVE-2024-55887 Ucum-java has an XXE vulnerability in XML parsing
- CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins
- CVE-2024-55885 Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames
- CVE-2024-55884 In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhauste
- CVE-2024-55881 KVM: x86: Play nice with protected guests in complete_hypercall_exit()
- CVE-2024-5588 itsourcecode Learning Management System processscore.php sql injection
- CVE-2024-55879 XWiki allows RCE from script right in configurable sections
- CVE-2024-55878 Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx
- CVE-2024-55877 XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
- CVE-2024-55876 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user
- CVE-2024-55875 http4k has a potential XXE (XML External Entity Injection) vulnerability
- CVE-2024-5587 Casdoor Configuration File app.conf file access
- CVE-2024-55864 Cross-site scripting in My WP Customize Admin/Frontend
- CVE-2024-5586 SQL Injection
- CVE-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
- CVE-2024-5584 Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly
- CVE-2024-5583 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-5582 Cross-site scripting in Schema & Structured Data for WP & AMP
- CVE-2024-5581 Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability
- CVE-2024-5580 Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-5579 Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-5578 Table of Contents Plus <= 2408 - Editor+ Stored XSS
- CVE-2024-5577 Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion
- CVE-2024-5576 Cross-site scripting in Tutor LMS Elementor Addons
- CVE-2024-5575 Ditty < 3.1.43 - Author+ Stored XSS
- CVE-2024-5574 WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-5573 Easy Table of Contents < 2.0.66 - Admin+ Stored XSS
- CVE-2024-5571 Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-5570 Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update
- CVE-2024-5569 Denial of Service via crafted zip file in jaraco/zipp
- CVE-2024-5567 Cross-site scripting in Betheme
- CVE-2024-55663 XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
- CVE-2024-55662 XWiki allows remote code execution through the extension sheet
- CVE-2024-55661 Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
- CVE-2024-55660 SiYuan has an SSTI via /api/template/renderSprig
- CVE-2024-5566 Improper Privilege Management allows for access to unauthorized repository content during migration
- CVE-2024-55659 SiYuan has an arbitrary file write in the host via /api/asset/upload
- CVE-2024-55658 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources